ock 130, lost async page write 01:27:57 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) dup2(r3, 0xffffffffffffffff) 01:27:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000200"}) [ 1328.773869][ T5265] attempt to access beyond end of device [ 1328.791386][ T5265] loop0: rw=2049, want=132, limit=128 01:27:57 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) [ 1328.861542][ T5265] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1328.881445][ T5265] attempt to access beyond end of device [ 1328.887274][ T5265] loop0: rw=2049, want=133, limit=128 [ 1328.929566][ T5265] attempt to access beyond end of device [ 1328.945142][ T5265] loop0: rw=2049, want=142, limit=128 [ 1328.958286][ T5265] attempt to access beyond end of device [ 1328.969773][ T5265] loop0: rw=2049, want=143, limit=128 [ 1328.982180][ T5265] attempt to access beyond end of device [ 1328.992707][ T5265] loop0: rw=2049, want=144, limit=128 [ 1329.005957][ T5265] attempt to access beyond end of device [ 1329.012716][ T5265] loop0: rw=2049, want=145, limit=128 [ 1329.075245][ T5265] attempt to access beyond end of device [ 1329.082066][ T5265] loop0: rw=2049, want=5545, limit=128 [ 1329.128280][ T5265] attempt to access beyond end of device [ 1329.134453][ T5265] loop0: rw=2049, want=14873, limit=128 [ 1329.151586][ T5265] attempt to access beyond end of device [ 1329.157432][ T5265] loop0: rw=2049, want=15689, limit=128 01:27:57 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x38) 01:27:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000300"}) 01:27:57 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) dup2(r3, 0xffffffffffffffff) 01:27:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x74, 0x4) 01:27:58 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000400"}) 01:27:58 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(0xffffffffffffffff, r3) 01:27:58 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) 01:27:58 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000500"}) 01:27:58 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x0, 0x989680}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) add_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000180)="8e37742f49772d3d40d355c339025894109c29ef69bde0d57c687039e77021c8ad64370f3b7a370d3d708cde2acc10786aca41d9de61d64203d64af3864dd230822a8730895cb314aec41e5b729769d8840e33599cc83becc4afddb30000ae2050d51745d30c785ecee8af94be951921f1134b7e95a5b760c55c37261bc7df76bc4f14b51fecbf1f03087df614f91a8ac1242b4326309bcabc4367020a8b3ed48b1ffbce4cdd4d96e224bb73761fab4acad41d28a2cc1040f89976665eeaf8f43088ab1dfacfc8b98a659e", 0xcb, 0xfffffffffffffffa) tkill(r0, 0x1000000000016) 01:27:58 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(0xffffffffffffffff, r3) 01:27:58 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) 01:27:58 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(0xffffffffffffffff, r3) [ 1329.988218][ C0] net_ratelimit: 19 callbacks suppressed [ 1329.988227][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1329.999822][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1330.068226][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1330.074041][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1330.079946][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1330.085819][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1330.252636][ T5317] attempt to access beyond end of device [ 1330.258652][ T5317] loop5: rw=2049, want=130, limit=128 [ 1330.264188][ T5317] attempt to access beyond end of device [ 1330.269991][ T5317] loop5: rw=2049, want=131, limit=128 [ 1330.275656][ T5317] attempt to access beyond end of device [ 1330.281536][ T5317] loop5: rw=2049, want=132, limit=128 [ 1330.287173][ T5317] attempt to access beyond end of device [ 1330.293149][ T5317] loop5: rw=2049, want=133, limit=128 [ 1330.298807][ T5317] attempt to access beyond end of device [ 1330.304560][ T5317] loop5: rw=2049, want=142, limit=128 [ 1330.310245][ T5317] attempt to access beyond end of device [ 1330.316035][ T5317] loop5: rw=2049, want=143, limit=128 [ 1330.321858][ T5317] attempt to access beyond end of device [ 1330.327731][ T5317] loop5: rw=2049, want=144, limit=128 [ 1330.333415][ T5317] attempt to access beyond end of device [ 1330.339331][ T5317] loop5: rw=2049, want=145, limit=128 [ 1330.352683][ T5317] attempt to access beyond end of device [ 1330.358601][ T5317] loop5: rw=2049, want=3313, limit=128 [ 1330.372670][ T5317] attempt to access beyond end of device [ 1330.378594][ T5317] loop5: rw=2049, want=5393, limit=128 [ 1330.393469][ T5317] attempt to access beyond end of device [ 1330.399388][ T5317] loop5: rw=2049, want=7201, limit=128 [ 1330.995765][ T5354] attempt to access beyond end of device [ 1331.001598][ T5354] loop0: rw=2049, want=130, limit=128 [ 1331.006994][ T5354] attempt to access beyond end of device [ 1331.016239][ T5354] loop0: rw=2049, want=131, limit=128 [ 1331.021723][ T5354] attempt to access beyond end of device [ 1331.027358][ T5354] loop0: rw=2049, want=132, limit=128 [ 1331.036338][ T5354] attempt to access beyond end of device [ 1331.042046][ T5354] loop0: rw=2049, want=133, limit=128 [ 1331.047438][ T5354] attempt to access beyond end of device [ 1331.056763][ T5354] loop0: rw=2049, want=142, limit=128 [ 1331.062277][ T5354] attempt to access beyond end of device [ 1331.067905][ T5354] loop0: rw=2049, want=143, limit=128 [ 1331.077183][ T5354] attempt to access beyond end of device [ 1331.082929][ T5354] loop0: rw=2049, want=144, limit=128 [ 1331.088607][ T5354] attempt to access beyond end of device [ 1331.094254][ T5354] loop0: rw=2049, want=145, limit=128 [ 1331.103306][ T5354] attempt to access beyond end of device [ 1331.109207][ T5354] loop0: rw=2049, want=3145, limit=128 [ 1331.117736][ T5354] attempt to access beyond end of device [ 1331.123499][ T5354] loop0: rw=2049, want=5193, limit=128 [ 1331.132197][ T5354] attempt to access beyond end of device [ 1331.137840][ T5354] loop0: rw=2049, want=7817, limit=128 [ 1331.146511][ T5354] attempt to access beyond end of device [ 1331.152272][ T5354] loop0: rw=2049, want=10001, limit=128 [ 1331.165583][ T5354] attempt to access beyond end of device [ 1331.171273][ T5354] loop0: rw=2049, want=13937, limit=128 [ 1331.184382][ T5354] attempt to access beyond end of device [ 1331.190258][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1331.190303][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1331.198145][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1331.201863][ T5354] loop0: rw=2049, want=17465, limit=128 [ 1331.207566][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1331.226544][ T5354] attempt to access beyond end of device [ 1331.232824][ T5354] loop0: rw=2049, want=24441, limit=128 01:28:00 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000600"}) 01:28:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) 01:28:00 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x7a, 0x4) 01:28:00 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x3e) 01:28:00 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x0, 0x989680}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) ioctl$MON_IOCX_GET(r2, 0x40189206, &(0x7f0000000080)={&(0x7f0000000040), &(0x7f0000000180)=""/172, 0xac}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r4 = dup(r3) ioprio_get$pid(0x2, r0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) tkill(r0, 0x1000000000016) r5 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x0, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r7 = dup(r6) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8b04, &(0x7f0000000600)='wlan1\x00\a\xd3~\xd4\xa2\xb8y\xe1\x04\xbe\x0e\x02\x00\x00\x00\x00\x00@!\a\xff\x8d\x92\x88\xdc\x80\xf9\x01\x06\x8c\xe2K\x04\xd9\xfd\xbd\x00\x1d})\xa0\xb1\xd2\xe4\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xfd\xfd\x00\a\x00\x18\x9f \xfa\x91\x1b\x01U\xbe\x01\x01X\xbdh\xbfjOc\xcd\x15\xc1K\xab\xe9\xe3\xe8\x05\xda\xce\xed\xa5\xb8<\x9d\xd1\x19EI\x952\x12,\xec\x02:a\xad\xef,\xbc (\x02B-mF\xfa\x92\xdc\x13\x06\x1fk6=z\x8eni)\xb5i\x0f\xc7\v\x9d\x81\xb3r\xb1x\\\xdb\xcbzE\xfeO\xe7\xdf\x96\xa2\xf8EX\xe3\xbcf\x02\x98T\x1a\x1f\x16\xb9\b\xa2\xb0\a\x00vCh>\xa3\xd7\xc70\x92C5\x9d\x17\xd1\x96g\x8d\xd1\x06i\xde<\xf3\xd9\x93M/\x1eQ\xba\xe7[\xe3\x00\x00\x00\x00\x00\x00t\xeeKr\xb3\"\xa9\xef\xa2\xd8\x03_\xee=[o\xaa \x91d\xff9\xfa\r\xbe\x16%\xde\xa2o\xa9\\%\xc8\xfa\xd9t\xe5t\x99\xb9j\x16\xc4}-\xf6\xd3\x02\x00\x00\x00\x00\x00\x00\x00\x10\x04\x00\x00\x00\xd0\xab.\x13L8V\x1d\xa0\x02#\xb4\xea@\x1b\xd0{\x02iE\xb30\xe8\xdb[\xc8\xe5\xae\x98\xdc\xe4Tr\xb4w\xba\xa9\xfe\x0f\xdcFc\xd0\x9f\x82\x9d\xae\x9cy\xb3QOT\xdc\x86\x82Q\xe0\xab\xc1w\x03;-^(\x02=\xf39\xe9yT\xc4\xf0\xef\xe0X\b#\x9a\xcd\xe0\xf8q\x9a\xcd\xdeAF,\x04\"\x84\xa9O\x97\xf7\xfb\xa2N>\xcb\x9d\xc0\xcc\x13\x12\xcc@\x89\xf8F\x82OO\x990\xcei\xf2\xd1\x86\xc3j2m\xf6B\x19=h\x8fe\xc2\x13\x92?||\xbf\x10\x8f$\xdf^\xba\x04^\x13\r}\xd2n?3O\xb5\xa8\xfa\xfe\xe6\x92\xfd\x1c\xbc\x15\x81G\xbeC\xb2\x80\x87\x83\xb6\xf7wz\xcf\xa3c\xac\xe56\x8cg\x15\x9e\x96c') r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_LINK_STATS(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x30, r9, 0x23f}, 0x30}, 0x1, 0xfffffff0}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r7, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r9, 0x100, 0x70bd27, 0x25dfdbfd, {}, ["", "", ""]}, 0x1c}}, 0x4) sendmsg$TIPC_CMD_SET_LINK_PRI(r5, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40002084}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x68, r9, 0x200, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x3ff, @media='ib\x00'}}}, ["", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x44048048}, 0x20000010) [ 1331.248359][ T5354] attempt to access beyond end of device [ 1331.254021][ T5354] loop0: rw=2049, want=31449, limit=128 [ 1331.262615][ T5354] attempt to access beyond end of device [ 1331.268337][ T5354] loop0: rw=2049, want=31465, limit=128 01:28:00 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:00 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r2) 01:28:00 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:28:00 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x0, 0x989680}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = dup(r1) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, 0x0, 0xffffffff) setsockopt$RDS_CANCEL_SENT_TO(r4, 0x114, 0x1, &(0x7f0000000040)={0x2, 0x4e21, @broadcast}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x1000000000016) 01:28:00 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r0, r1) 01:28:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:28:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1332.202870][ T5371] attempt to access beyond end of device [ 1332.248550][ T5371] loop5: rw=2049, want=130, limit=128 [ 1332.254150][ T5371] attempt to access beyond end of device [ 1332.260384][ T5371] loop5: rw=2049, want=131, limit=128 [ 1332.265925][ T5371] attempt to access beyond end of device [ 1332.272067][ T5371] loop5: rw=2049, want=132, limit=128 [ 1332.277644][ T5371] attempt to access beyond end of device [ 1332.284983][ T5371] loop5: rw=2049, want=133, limit=128 [ 1332.297142][ T5371] attempt to access beyond end of device [ 1332.328657][ T5371] loop5: rw=2049, want=142, limit=128 [ 1332.336542][ T5371] attempt to access beyond end of device [ 1332.345861][ T5371] loop5: rw=2049, want=143, limit=128 [ 1332.354801][ T5371] attempt to access beyond end of device [ 1332.364036][ T5371] loop5: rw=2049, want=144, limit=128 [ 1332.373023][ T5371] attempt to access beyond end of device [ 1332.382470][ T5371] loop5: rw=2049, want=145, limit=128 [ 1332.415000][ T5371] attempt to access beyond end of device [ 1332.432531][ T5371] loop5: rw=2049, want=3201, limit=128 01:28:01 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x88, 0x4) [ 1332.468393][ T5371] attempt to access beyond end of device [ 1332.474126][ T5371] loop5: rw=2049, want=5305, limit=128 [ 1333.200534][ T5423] attempt to access beyond end of device [ 1333.206246][ T5423] loop0: rw=2049, want=130, limit=128 [ 1333.212124][ T5423] attempt to access beyond end of device [ 1333.217928][ T5423] loop0: rw=2049, want=131, limit=128 [ 1333.230925][ T5423] attempt to access beyond end of device [ 1333.237137][ T5423] loop0: rw=2049, want=132, limit=128 [ 1333.247102][ T5423] attempt to access beyond end of device [ 1333.257730][ T5423] loop0: rw=2049, want=133, limit=128 [ 1333.267111][ T5423] buffer_io_error: 32 callbacks suppressed [ 1333.267122][ T5423] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1333.289512][ T5423] attempt to access beyond end of device [ 1333.295415][ T5423] loop0: rw=2049, want=142, limit=128 [ 1333.305763][ T5423] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1333.316921][ T5423] attempt to access beyond end of device [ 1333.327468][ T5423] loop0: rw=2049, want=143, limit=128 [ 1333.335562][ T5423] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1333.351842][ T5423] attempt to access beyond end of device [ 1333.358819][ T5423] loop0: rw=2049, want=144, limit=128 [ 1333.364364][ T5423] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1333.381028][ T5423] attempt to access beyond end of device [ 1333.386845][ T5423] loop0: rw=2049, want=145, limit=128 [ 1333.397254][ T5423] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1333.416764][ T5423] attempt to access beyond end of device [ 1333.424092][ T5423] loop0: rw=2049, want=2273, limit=128 [ 1333.443047][ T5423] attempt to access beyond end of device [ 1333.455602][ T5423] loop0: rw=2049, want=5081, limit=128 [ 1333.468345][ T5423] attempt to access beyond end of device [ 1333.474160][ T5423] loop0: rw=2049, want=7137, limit=128 [ 1333.492679][ T5423] attempt to access beyond end of device [ 1333.505816][ T5423] loop0: rw=2049, want=9185, limit=128 [ 1333.522879][ T5423] attempt to access beyond end of device [ 1333.556229][ T5423] loop0: rw=2049, want=12801, limit=128 [ 1333.587471][ T5431] attempt to access beyond end of device [ 1333.595709][ T5423] attempt to access beyond end of device [ 1333.601582][ T5423] loop0: rw=2049, want=18065, limit=128 [ 1333.608231][ T5431] loop5: rw=2049, want=130, limit=128 [ 1333.613652][ T5431] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1333.628002][ T5423] attempt to access beyond end of device [ 1333.634082][ T5431] attempt to access beyond end of device [ 1333.639836][ T5431] loop5: rw=2049, want=131, limit=128 [ 1333.640078][ T5423] loop0: rw=2049, want=23017, limit=128 [ 1333.645212][ T5431] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1333.645254][ T5431] attempt to access beyond end of device [ 1333.665124][ T5431] loop5: rw=2049, want=132, limit=128 [ 1333.670614][ T5431] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1333.679211][ T5431] attempt to access beyond end of device 01:28:02 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x5f) 01:28:02 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r0, r1) 01:28:02 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x0, 0x989680}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r3, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r4, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r5 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r4, r5, 0x0, 0xffffffff) ioctl$KVM_GET_XSAVE(r5, 0x9000aea4, &(0x7f0000000480)) timer_settime(r3, 0x0, &(0x7f0000000080)={{0x77359400}}, &(0x7f0000000100)) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r6, r7, 0x0, 0xffffffff) setsockopt$inet_tcp_TLS_TX(r7, 0x6, 0x1, &(0x7f0000000040)=@gcm_256={{}, "5a6cb8da8e14fe00", "f8c6ec926bbdde16d4a2f904ae627a19b987f6b71923548bc3cce71ebe7655ac", "626351a2", "1b98dea0613bfbe5"}, 0x38) tkill(r0, 0x1000000000016) 01:28:02 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:28:02 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r2) [ 1333.684848][ T5431] loop5: rw=2049, want=133, limit=128 [ 1333.708153][ T5431] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1333.728162][ T5431] attempt to access beyond end of device 01:28:02 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000fffffdfd00"}) [ 1333.757008][ T5431] loop5: rw=2049, want=142, limit=128 [ 1333.770421][ T5431] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1333.790275][ T5431] attempt to access beyond end of device 01:28:02 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r0, r1) [ 1333.843066][ T5431] loop5: rw=2049, want=143, limit=128 [ 1333.862858][ T5431] attempt to access beyond end of device [ 1333.883480][ T5431] loop5: rw=2049, want=144, limit=128 01:28:02 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000ff00"}) [ 1333.892782][ T5431] attempt to access beyond end of device [ 1333.907781][ T5431] loop5: rw=2049, want=145, limit=128 [ 1333.918946][ T5431] attempt to access beyond end of device [ 1333.935841][ T5431] loop5: rw=2049, want=3097, limit=128 01:28:02 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000fdfdffff00"}) 01:28:02 executing program 2: r0 = gettid() timer_create(0xd, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x0, 0x989680}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x1000000000016) [ 1334.023851][ T5431] attempt to access beyond end of device [ 1334.048161][ T5431] loop5: rw=2049, want=8793, limit=128 01:28:02 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r1, r2) [ 1334.265199][ T5431] attempt to access beyond end of device [ 1334.283251][ T5431] loop5: rw=2049, want=27873, limit=128 01:28:03 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000100"}) [ 1335.293196][ T5478] attempt to access beyond end of device [ 1335.298919][ T5478] loop0: rw=2049, want=130, limit=128 [ 1335.304303][ T5478] attempt to access beyond end of device [ 1335.310049][ T5478] loop0: rw=2049, want=131, limit=128 [ 1335.315467][ T5478] attempt to access beyond end of device [ 1335.329779][ T5478] loop0: rw=2049, want=132, limit=128 [ 1335.335225][ T5478] attempt to access beyond end of device [ 1335.341088][ T5478] loop0: rw=2049, want=133, limit=128 [ 1335.346523][ T5478] attempt to access beyond end of device [ 1335.352325][ C0] net_ratelimit: 20 callbacks suppressed [ 1335.352333][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1335.352403][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1335.358155][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1335.358207][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1335.364059][ T5478] loop0: rw=2049, want=142, limit=128 [ 1335.386544][ T5478] attempt to access beyond end of device [ 1335.392867][ T5478] loop0: rw=2049, want=143, limit=128 [ 1335.399349][ T5478] attempt to access beyond end of device [ 1335.404990][ T5478] loop0: rw=2049, want=144, limit=128 [ 1335.410472][ T5478] attempt to access beyond end of device [ 1335.416102][ T5478] loop0: rw=2049, want=145, limit=128 [ 1335.424751][ T5478] attempt to access beyond end of device [ 1335.430519][ T5478] loop0: rw=2049, want=3161, limit=128 [ 1335.440495][ T5478] attempt to access beyond end of device [ 1335.446149][ T5478] loop0: rw=2049, want=5209, limit=128 [ 1335.454642][ T5478] attempt to access beyond end of device [ 1335.460340][ T5478] loop0: rw=2049, want=7265, limit=128 [ 1335.469386][ T5478] attempt to access beyond end of device [ 1335.475034][ T5478] loop0: rw=2049, want=9313, limit=128 [ 1335.484815][ T5478] attempt to access beyond end of device [ 1335.490538][ T5478] loop0: rw=2049, want=12849, limit=128 [ 1335.504325][ T5478] attempt to access beyond end of device [ 1335.510034][ T5478] loop0: rw=2049, want=16945, limit=128 [ 1335.526462][ T5478] attempt to access beyond end of device [ 1335.532741][ T5478] loop0: rw=2049, want=23569, limit=128 [ 1335.551089][ T5478] attempt to access beyond end of device [ 1335.556750][ T5478] loop0: rw=2049, want=32881, limit=128 [ 1335.566904][ T5481] attempt to access beyond end of device [ 1335.572701][ T5481] loop0: rw=2049, want=130, limit=128 [ 1335.578247][ T5481] attempt to access beyond end of device [ 1335.578261][ T5481] loop0: rw=2049, want=131, limit=128 [ 1335.578295][ T5481] attempt to access beyond end of device [ 1335.578306][ T5481] loop0: rw=2049, want=132, limit=128 [ 1335.578338][ T5481] attempt to access beyond end of device [ 1335.578349][ T5481] loop0: rw=2049, want=133, limit=128 [ 1335.578382][ T5481] attempt to access beyond end of device [ 1335.618350][ T5481] loop0: rw=2049, want=142, limit=128 [ 1335.623757][ T5481] attempt to access beyond end of device [ 1335.629452][ T5481] loop0: rw=2049, want=143, limit=128 [ 1335.634862][ T5481] attempt to access beyond end of device [ 1335.640528][ T5481] loop0: rw=2049, want=144, limit=128 [ 1335.645919][ T5481] attempt to access beyond end of device 01:28:04 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x60) 01:28:04 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x1cf, 0x4) 01:28:04 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r1, r2) 01:28:04 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000800100"}) 01:28:04 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r2) [ 1335.651619][ T5481] loop0: rw=2049, want=145, limit=128 01:28:04 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000200"}) 01:28:04 executing program 4: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r1, r2) 01:28:04 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000300"}) 01:28:04 executing program 4: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1336.148173][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1336.154045][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1336.228183][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1336.228284][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1336.308304][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1336.314208][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1336.622974][ T5491] attempt to access beyond end of device [ 1336.631063][ T5491] loop5: rw=2049, want=130, limit=128 [ 1336.636714][ T5491] attempt to access beyond end of device [ 1336.669064][ T5491] loop5: rw=2049, want=131, limit=128 [ 1336.674507][ T5491] attempt to access beyond end of device [ 1336.692005][ T5491] loop5: rw=2049, want=132, limit=128 [ 1336.697436][ T5491] attempt to access beyond end of device [ 1336.706737][ T5491] loop5: rw=2049, want=133, limit=128 [ 1336.712930][ T5491] attempt to access beyond end of device [ 1336.718909][ T5491] loop5: rw=2049, want=142, limit=128 [ 1336.724944][ T5491] attempt to access beyond end of device [ 1336.731112][ T5491] loop5: rw=2049, want=143, limit=128 [ 1336.736522][ T5491] attempt to access beyond end of device [ 1336.742513][ T5491] loop5: rw=2049, want=144, limit=128 [ 1336.748458][ T5491] attempt to access beyond end of device [ 1336.754103][ T5491] loop5: rw=2049, want=145, limit=128 [ 1336.763265][ T5491] attempt to access beyond end of device [ 1336.770138][ T5491] loop5: rw=2049, want=2209, limit=128 [ 1336.780888][ T5491] attempt to access beyond end of device [ 1336.786536][ T5491] loop5: rw=2049, want=4329, limit=128 [ 1336.797377][ T5491] attempt to access beyond end of device [ 1336.803360][ T5491] loop5: rw=2049, want=6377, limit=128 [ 1336.814704][ T5491] attempt to access beyond end of device [ 1336.820741][ T5491] loop5: rw=2049, want=8745, limit=128 [ 1336.834638][ T5491] attempt to access beyond end of device [ 1336.840338][ T5491] loop5: rw=2049, want=12673, limit=128 [ 1336.855533][ T5491] attempt to access beyond end of device [ 1336.861412][ T5491] loop5: rw=2049, want=16593, limit=128 [ 1336.872981][ T5491] attempt to access beyond end of device [ 1336.879550][ T5491] loop5: rw=2049, want=18337, limit=128 01:28:05 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x7, 0x0, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x1000000000016) 01:28:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000400"}) 01:28:05 executing program 4: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1337.490803][ T5516] attempt to access beyond end of device [ 1337.506024][ T5516] loop0: rw=2049, want=130, limit=128 [ 1337.511695][ T5516] attempt to access beyond end of device [ 1337.517462][ T5516] loop0: rw=2049, want=131, limit=128 [ 1337.523400][ T5516] attempt to access beyond end of device [ 1337.535202][ T5516] loop0: rw=2049, want=132, limit=128 [ 1337.540878][ T5516] attempt to access beyond end of device [ 1337.546505][ T5516] loop0: rw=2049, want=133, limit=128 [ 1337.556209][ T5516] attempt to access beyond end of device [ 1337.561912][ T5516] loop0: rw=2049, want=142, limit=128 [ 1337.567312][ T5516] attempt to access beyond end of device [ 1337.576688][ T5516] loop0: rw=2049, want=143, limit=128 [ 1337.582193][ T5516] attempt to access beyond end of device [ 1337.587839][ T5516] loop0: rw=2049, want=144, limit=128 [ 1337.593487][ T5516] attempt to access beyond end of device [ 1337.599203][ T5516] loop0: rw=2049, want=145, limit=128 [ 1337.613164][ T5516] attempt to access beyond end of device [ 1337.618871][ T5516] loop0: rw=2049, want=7225, limit=128 [ 1337.629904][ T5516] attempt to access beyond end of device [ 1337.635634][ T5516] loop0: rw=2049, want=9273, limit=128 [ 1337.644979][ T5516] attempt to access beyond end of device [ 1337.650659][ T5516] loop0: rw=2049, want=12505, limit=128 [ 1337.660646][ T5516] attempt to access beyond end of device [ 1337.666285][ T5516] loop0: rw=2049, want=14681, limit=128 [ 1337.676608][ T5516] attempt to access beyond end of device [ 1337.682339][ T5516] loop0: rw=2049, want=16889, limit=128 01:28:06 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x300, 0x4) 01:28:06 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) close(0xffffffffffffffff) 01:28:06 executing program 4: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:06 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000500"}) 01:28:06 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x1cf) 01:28:06 executing program 2: gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x5, 0x0, &(0x7f0000000000)={0x0, 0x989680}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = inotify_init1(0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, 0x0, 0xffffffff) connect$rose(r4, &(0x7f0000000080)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null]}, 0x40) fcntl$setown(r2, 0x8, 0xffffffffffffffff) fcntl$getownex(r2, 0x10, &(0x7f000045fff8)={0x0, 0x0}) rt_sigqueueinfo(r5, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffff9}) r6 = inotify_init1(0x0) fcntl$setown(r6, 0x8, 0xffffffffffffffff) fcntl$getownex(r6, 0x10, &(0x7f000045fff8)={0x0, 0x0}) rt_sigqueueinfo(r7, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffff9}) tkill(r7, 0x1000000000016) [ 1337.693624][ T5516] attempt to access beyond end of device [ 1337.699475][ T5516] loop0: rw=2049, want=19945, limit=128 [ 1337.706744][ T5516] attempt to access beyond end of device [ 1337.712443][ T5516] loop0: rw=2049, want=20289, limit=128 01:28:06 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000600"}) 01:28:06 executing program 4: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r1, r2) 01:28:06 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:06 executing program 4: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r1, r2) 01:28:06 executing program 2: r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x0, 0x989680}, &(0x7f00000000c0)) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000040)=0x0) timer_settime(r1, 0x0, &(0x7f0000000180)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) timer_getoverrun(r1) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r3 = dup(r2) ioctl$TIOCSBRK(r3, 0x5427) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r0, 0x1000000000016) 01:28:07 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1338.676381][ T5537] attempt to access beyond end of device [ 1338.695358][ T5537] loop5: rw=2049, want=130, limit=128 [ 1338.701112][ T5537] buffer_io_error: 35 callbacks suppressed [ 1338.701122][ T5537] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1338.730740][ T5537] attempt to access beyond end of device [ 1338.737283][ T5537] loop5: rw=2049, want=131, limit=128 [ 1338.743757][ T5537] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1338.763150][ T5537] attempt to access beyond end of device [ 1338.778130][ T5537] loop5: rw=2049, want=132, limit=128 [ 1338.783559][ T5537] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1338.799370][ T5537] attempt to access beyond end of device [ 1338.805204][ T5537] loop5: rw=2049, want=133, limit=128 [ 1338.819544][ T5537] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1338.834645][ T5537] attempt to access beyond end of device [ 1338.840700][ T5537] loop5: rw=2049, want=142, limit=128 [ 1338.846277][ T5537] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1338.862258][ T5537] attempt to access beyond end of device [ 1338.870590][ T5537] loop5: rw=2049, want=143, limit=128 [ 1338.876170][ T5537] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1338.890265][ T5537] attempt to access beyond end of device [ 1338.896160][ T5537] loop5: rw=2049, want=144, limit=128 [ 1338.908110][ T5537] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1338.916677][ T5537] attempt to access beyond end of device [ 1338.930524][ T5537] loop5: rw=2049, want=145, limit=128 [ 1338.943014][ T5537] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1338.962056][ T5537] attempt to access beyond end of device [ 1338.967911][ T5537] loop5: rw=2049, want=3449, limit=128 [ 1338.983213][ T5537] attempt to access beyond end of device [ 1338.989159][ T5537] loop5: rw=2049, want=6537, limit=128 [ 1339.002480][ T5537] attempt to access beyond end of device [ 1339.008408][ T5537] loop5: rw=2049, want=8737, limit=128 [ 1339.020375][ T5537] attempt to access beyond end of device [ 1339.026219][ T5537] loop5: rw=2049, want=10801, limit=128 [ 1339.044715][ T5537] attempt to access beyond end of device [ 1339.051882][ T5537] loop5: rw=2049, want=13337, limit=128 01:28:07 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x500, 0x4) 01:28:07 executing program 4: socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r1, r2) 01:28:07 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:28:07 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) close(0xffffffffffffffff) [ 1339.563921][ T5578] attempt to access beyond end of device [ 1339.569886][ T5578] loop0: rw=2049, want=130, limit=128 [ 1339.575475][ T5578] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1339.598768][ T5578] attempt to access beyond end of device [ 1339.614733][ T5578] loop0: rw=2049, want=131, limit=128 [ 1339.625914][ T5578] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1339.648164][ T5578] attempt to access beyond end of device [ 1339.659130][ T5578] loop0: rw=2049, want=132, limit=128 [ 1339.664552][ T5578] attempt to access beyond end of device [ 1339.670259][ T5578] loop0: rw=2049, want=133, limit=128 [ 1339.675897][ T5578] attempt to access beyond end of device [ 1339.681829][ T5578] loop0: rw=2049, want=142, limit=128 [ 1339.687252][ T5578] attempt to access beyond end of device [ 1339.693075][ T5578] loop0: rw=2049, want=143, limit=128 [ 1339.698799][ T5578] attempt to access beyond end of device [ 1339.704445][ T5578] loop0: rw=2049, want=144, limit=128 [ 1339.710078][ T5578] attempt to access beyond end of device [ 1339.715959][ T5578] loop0: rw=2049, want=145, limit=128 [ 1339.725152][ T5578] attempt to access beyond end of device [ 1339.731067][ T5578] loop0: rw=2049, want=2193, limit=128 [ 1339.747023][ T5578] attempt to access beyond end of device [ 1339.755501][ T5578] loop0: rw=2049, want=6337, limit=128 [ 1339.784575][ T5578] attempt to access beyond end of device [ 1339.795037][ T5578] loop0: rw=2049, want=11233, limit=128 [ 1339.821363][ T5578] attempt to access beyond end of device [ 1339.827399][ T5578] loop0: rw=2049, want=14641, limit=128 [ 1339.847221][ T5578] attempt to access beyond end of device [ 1339.857520][ T5578] loop0: rw=2049, want=16705, limit=128 [ 1339.871317][ T5578] attempt to access beyond end of device [ 1339.877143][ T5578] loop0: rw=2049, want=18753, limit=128 01:28:08 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x3800) 01:28:08 executing program 2: rt_sigaction(0x16, &(0x7f0000000180)={&(0x7f0000000080)="813e6ada0000c4418310ed672e6464f2afc4e175db0474660f75c18fa9e80197d5000000450fae22670fede08f4940020836f20f2de8", {0x401}, 0x8000004, &(0x7f0000000100)="c4e15d5e74b80045805100ba0f8b0783c7c70fec4e05c4224dafe2660f38df48e5d9f9f3400fb8f48f6aa81283008000003d000000c4e129f9ace974000000"}, &(0x7f0000000280)={&(0x7f00000001c0)="3636f20ff0a1775500002bee64aec4e27d19cb0f01ef66460ff3d047ffa500000000c40111ee23da2d9f2c0231c4e185edbf00800000", {}, 0x0, &(0x7f0000000200)="260f8e000000803e66440fae741f30c4c290f35018c4a1c5db8190da1e3764670f579e340f0000f2f0422957001a9c08e1e6c12066470f1009c4619916b1a1000000c46251acbc53f77f0000"}, 0x8, &(0x7f00000002c0)) r0 = gettid() sched_getaffinity(0xffffffffffffffff, 0x8, &(0x7f0000000040)) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x0, 0x989680}, &(0x7f00000000c0)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x1000000000016) 01:28:08 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:28:08 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) [ 1339.893892][ T5578] attempt to access beyond end of device [ 1339.908238][ T5578] loop0: rw=2049, want=22545, limit=128 01:28:08 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:28:08 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) close(0xffffffffffffffff) 01:28:08 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:08 executing program 2: r0 = gettid() timer_create(0x4, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000044000)) clock_nanosleep(0x2, 0x0, &(0x7f0000000000)={0x77359400}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000700)) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) tkill(r0, 0x1000000000016) [ 1340.388260][ C0] net_ratelimit: 20 callbacks suppressed [ 1340.388268][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1340.399781][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1340.437338][ T5597] attempt to access beyond end of device [ 1340.461685][ T5597] loop5: rw=2049, want=130, limit=128 [ 1340.467285][ T5597] attempt to access beyond end of device [ 1340.473146][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1340.473205][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1340.473325][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1340.473380][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1340.504937][ T5597] loop5: rw=2049, want=131, limit=128 [ 1340.510580][ T5597] attempt to access beyond end of device [ 1340.516349][ T5597] loop5: rw=2049, want=132, limit=128 [ 1340.528392][ T5597] attempt to access beyond end of device [ 1340.534171][ T5597] loop5: rw=2049, want=133, limit=128 [ 1340.545049][ T5597] attempt to access beyond end of device [ 1340.552005][ T5597] loop5: rw=2049, want=142, limit=128 [ 1340.557550][ T5597] attempt to access beyond end of device [ 1340.567590][ T5597] loop5: rw=2049, want=143, limit=128 [ 1340.573876][ T5597] attempt to access beyond end of device [ 1340.582887][ T5597] loop5: rw=2049, want=144, limit=128 [ 1340.589225][ T5597] attempt to access beyond end of device [ 1340.594855][ T5597] loop5: rw=2049, want=145, limit=128 [ 1340.624706][ T5597] attempt to access beyond end of device [ 1340.647200][ T5597] loop5: rw=2049, want=4665, limit=128 [ 1340.684729][ T5597] attempt to access beyond end of device [ 1340.690891][ T5597] loop5: rw=2049, want=13833, limit=128 01:28:09 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x600, 0x4) 01:28:09 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000fffffdfd00"}) 01:28:09 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) [ 1340.710468][ T5597] attempt to access beyond end of device [ 1340.716281][ T5597] loop5: rw=2049, want=16121, limit=128 [ 1340.724452][ T5597] attempt to access beyond end of device [ 1340.730330][ T5597] loop5: rw=2049, want=16353, limit=128 01:28:09 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000ff00"}) [ 1341.503830][ T5631] attempt to access beyond end of device [ 1341.517727][ T5631] loop0: rw=2049, want=130, limit=128 [ 1341.523857][ T5631] attempt to access beyond end of device [ 1341.536623][ T5631] loop0: rw=2049, want=131, limit=128 [ 1341.542620][ T5631] attempt to access beyond end of device [ 1341.556190][ T5631] loop0: rw=2049, want=132, limit=128 [ 1341.562426][ T5631] attempt to access beyond end of device [ 1341.575106][ T5631] loop0: rw=2049, want=133, limit=128 [ 1341.581040][ T5631] attempt to access beyond end of device [ 1341.586878][ T5631] loop0: rw=2049, want=142, limit=128 [ 1341.588218][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1341.592485][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1341.598032][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1341.603766][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1341.623126][ T5631] attempt to access beyond end of device [ 1341.631730][ T5631] loop0: rw=2049, want=143, limit=128 [ 1341.637344][ T5631] attempt to access beyond end of device [ 1341.650664][ T5631] loop0: rw=2049, want=144, limit=128 [ 1341.656306][ T5631] attempt to access beyond end of device [ 1341.668049][ T5631] loop0: rw=2049, want=145, limit=128 [ 1341.679419][ T5631] attempt to access beyond end of device [ 1341.685263][ T5631] loop0: rw=2049, want=2857, limit=128 [ 1341.698186][ T5631] attempt to access beyond end of device [ 1341.704037][ T5631] loop0: rw=2049, want=4905, limit=128 [ 1341.716031][ T5631] attempt to access beyond end of device [ 1341.722213][ T5631] loop0: rw=2049, want=6953, limit=128 [ 1341.734221][ T5631] attempt to access beyond end of device [ 1341.740085][ T5631] loop0: rw=2049, want=9073, limit=128 [ 1341.755262][ T5631] attempt to access beyond end of device [ 1341.761173][ T5631] loop0: rw=2049, want=12705, limit=128 [ 1341.780295][ T5631] attempt to access beyond end of device [ 1341.786148][ T5631] loop0: rw=2049, want=15969, limit=128 [ 1341.800413][ T5631] attempt to access beyond end of device 01:28:10 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x3e00) 01:28:10 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:10 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000ffffffff00"}) 01:28:10 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) [ 1341.806288][ T5631] loop0: rw=2049, want=18537, limit=128 01:28:10 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000200"}) 01:28:10 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:10 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) [ 1342.216741][ T5647] attempt to access beyond end of device [ 1342.255056][ T5647] loop5: rw=2049, want=130, limit=128 [ 1342.269236][ T5647] attempt to access beyond end of device [ 1342.276622][ T5647] loop5: rw=2049, want=131, limit=128 [ 1342.282392][ T5647] attempt to access beyond end of device [ 1342.296238][ T5647] loop5: rw=2049, want=132, limit=128 [ 1342.320398][ T5647] attempt to access beyond end of device [ 1342.330945][ T5647] loop5: rw=2049, want=133, limit=128 [ 1342.343403][ T5647] attempt to access beyond end of device [ 1342.356260][ T5647] loop5: rw=2049, want=142, limit=128 [ 1342.368291][ T5647] attempt to access beyond end of device [ 1342.373951][ T5647] loop5: rw=2049, want=143, limit=128 [ 1342.379784][ T5647] attempt to access beyond end of device [ 1342.385422][ T5647] loop5: rw=2049, want=144, limit=128 [ 1342.391349][ T5647] attempt to access beyond end of device [ 1342.396997][ T5647] loop5: rw=2049, want=145, limit=128 [ 1342.423411][ T5647] attempt to access beyond end of device [ 1342.430077][ T5647] loop5: rw=2049, want=4257, limit=128 [ 1342.469391][ T5647] attempt to access beyond end of device [ 1342.475154][ T5647] loop5: rw=2049, want=15393, limit=128 [ 1342.510771][ T5647] attempt to access beyond end of device [ 1342.522137][ T5647] loop5: rw=2049, want=18817, limit=128 01:28:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) 01:28:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000300"}) 01:28:12 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x700, 0x4) 01:28:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) [ 1343.273197][ T5677] attempt to access beyond end of device [ 1343.278976][ T5677] loop0: rw=2049, want=130, limit=128 [ 1343.284396][ T5677] attempt to access beyond end of device [ 1343.290266][ T5677] loop0: rw=2049, want=131, limit=128 [ 1343.295685][ T5677] attempt to access beyond end of device [ 1343.321856][ T5677] loop0: rw=2049, want=132, limit=128 [ 1343.327314][ T5677] attempt to access beyond end of device [ 1343.394281][ T5677] loop0: rw=2049, want=133, limit=128 [ 1343.408443][ T5677] attempt to access beyond end of device [ 1343.414392][ T5677] loop0: rw=2049, want=142, limit=128 [ 1343.454393][ T5677] attempt to access beyond end of device [ 1343.467245][ T5677] loop0: rw=2049, want=143, limit=128 [ 1343.478308][ T5677] attempt to access beyond end of device [ 1343.484084][ T5677] loop0: rw=2049, want=144, limit=128 [ 1343.554158][ T5677] attempt to access beyond end of device [ 1343.587381][ T5677] loop0: rw=2049, want=145, limit=128 [ 1343.633851][ T5677] attempt to access beyond end of device [ 1343.653823][ T5677] loop0: rw=2049, want=2977, limit=128 [ 1343.693133][ T5677] attempt to access beyond end of device [ 1343.703803][ T5677] loop0: rw=2049, want=5817, limit=128 [ 1343.718019][ T5677] attempt to access beyond end of device [ 1343.730518][ T5677] loop0: rw=2049, want=7865, limit=128 [ 1343.745212][ T5677] attempt to access beyond end of device [ 1343.751150][ T5677] loop0: rw=2049, want=9913, limit=128 [ 1343.766085][ T5677] attempt to access beyond end of device [ 1343.771953][ T5677] loop0: rw=2049, want=13841, limit=128 [ 1343.788551][ T5677] attempt to access beyond end of device [ 1343.794365][ T5677] loop0: rw=2049, want=17937, limit=128 [ 1343.831464][ T5677] attempt to access beyond end of device [ 1343.837148][ T5677] loop0: rw=2049, want=25217, limit=128 [ 1343.876803][ T5677] attempt to access beyond end of device [ 1343.882637][ T5677] loop0: rw=2049, want=32881, limit=128 [ 1343.895443][ T5680] attempt to access beyond end of device [ 1343.901274][ T5680] loop0: rw=2049, want=130, limit=128 [ 1343.906779][ T5680] buffer_io_error: 38 callbacks suppressed [ 1343.906792][ T5680] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1343.922757][ T5680] attempt to access beyond end of device [ 1343.928845][ T5680] loop0: rw=2049, want=131, limit=128 [ 1343.934372][ T5680] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1343.943291][ T5680] attempt to access beyond end of device [ 1343.952246][ T5680] loop0: rw=2049, want=132, limit=128 [ 1343.957840][ T5680] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1343.977191][ T5680] attempt to access beyond end of device [ 1343.984179][ T5680] loop0: rw=2049, want=133, limit=128 [ 1343.997199][ T5680] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1344.029382][ T5680] attempt to access beyond end of device [ 1344.035123][ T5680] loop0: rw=2049, want=142, limit=128 [ 1344.040552][ T5680] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1344.050147][ T5680] attempt to access beyond end of device [ 1344.055870][ T5680] loop0: rw=2049, want=143, limit=128 [ 1344.061389][ T5680] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1344.070067][ T5680] attempt to access beyond end of device 01:28:12 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000400"}) 01:28:12 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x5f00) [ 1344.075851][ T5680] loop0: rw=2049, want=144, limit=128 [ 1344.081386][ T5680] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1344.091144][ T5680] attempt to access beyond end of device [ 1344.096811][ T5680] loop0: rw=2049, want=145, limit=128 [ 1344.102257][ T5680] Buffer I/O error on dev loop0, logical block 144, lost async page write 01:28:12 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) [ 1344.149824][ T27] audit: type=1800 audit(1577150892.893:81): pid=5700 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="sda1" ino=17371 res=0 01:28:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x2000, 0x4) 01:28:13 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r2, r3) 01:28:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000500"}) 01:28:13 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) 01:28:13 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000600"}) 01:28:13 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\a\x00'}) 01:28:13 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1344.892696][ T5742] attempt to access beyond end of device [ 1344.935168][ T5742] loop5: rw=1, want=130, limit=128 [ 1344.941537][ T5742] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1344.958574][ T5742] attempt to access beyond end of device [ 1344.977320][ T5742] loop5: rw=1, want=131, limit=128 01:28:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\b\x00'}) [ 1344.992148][ T5742] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1345.015872][ T5742] attempt to access beyond end of device [ 1345.036019][ T5742] loop5: rw=1, want=132, limit=128 [ 1345.061636][ T5742] attempt to access beyond end of device [ 1345.089187][ T5742] loop5: rw=1, want=133, limit=128 [ 1345.134823][ T5742] attempt to access beyond end of device [ 1345.169675][ T5742] loop5: rw=1, want=142, limit=128 [ 1345.187882][ T5742] attempt to access beyond end of device [ 1345.231019][ T5742] loop5: rw=1, want=143, limit=128 [ 1345.270825][ T5742] attempt to access beyond end of device [ 1345.320654][ T5742] loop5: rw=1, want=144, limit=128 [ 1345.398277][ T5742] attempt to access beyond end of device [ 1345.416551][ T5742] loop5: rw=1, want=145, limit=128 [ 1345.609591][ T5734] attempt to access beyond end of device [ 1345.615524][ T5734] loop5: rw=2049, want=3593, limit=128 [ 1345.627610][ T5734] attempt to access beyond end of device [ 1345.633478][ T5734] loop5: rw=2049, want=5641, limit=128 [ 1345.644583][ T5734] attempt to access beyond end of device [ 1345.650439][ T5734] loop5: rw=2049, want=7689, limit=128 [ 1345.658727][ T5734] attempt to access beyond end of device [ 1345.664521][ T5734] loop5: rw=2049, want=8177, limit=128 [ 1345.748195][ C1] net_ratelimit: 20 callbacks suppressed [ 1345.748204][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1345.758160][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1345.759695][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1345.765406][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1346.158215][ T5754] attempt to access beyond end of device [ 1346.163886][ T5754] loop0: rw=2049, want=130, limit=128 [ 1346.169505][ T5754] attempt to access beyond end of device [ 1346.175139][ T5754] loop0: rw=2049, want=131, limit=128 [ 1346.180612][ T5754] attempt to access beyond end of device [ 1346.186252][ T5754] loop0: rw=2049, want=132, limit=128 [ 1346.191718][ T5754] attempt to access beyond end of device [ 1346.197346][ T5754] loop0: rw=2049, want=133, limit=128 [ 1346.202817][ T5754] attempt to access beyond end of device [ 1346.208480][ T5754] loop0: rw=2049, want=142, limit=128 [ 1346.213861][ T5754] attempt to access beyond end of device [ 1346.219542][ T5754] loop0: rw=2049, want=143, limit=128 [ 1346.224943][ T5754] attempt to access beyond end of device [ 1346.231204][ T5754] loop0: rw=2049, want=144, limit=128 [ 1346.236612][ T5754] attempt to access beyond end of device [ 1346.242332][ T5754] loop0: rw=2049, want=145, limit=128 [ 1346.250344][ T5754] attempt to access beyond end of device [ 1346.255972][ T5754] loop0: rw=2049, want=2769, limit=128 [ 1346.267626][ T5754] attempt to access beyond end of device [ 1346.273371][ T5754] loop0: rw=2049, want=5425, limit=128 [ 1346.285724][ T5754] attempt to access beyond end of device [ 1346.291476][ T5754] loop0: rw=2049, want=8721, limit=128 [ 1346.302067][ T5754] attempt to access beyond end of device [ 1346.307831][ T5754] loop0: rw=2049, want=10913, limit=128 [ 1346.317153][ T5754] attempt to access beyond end of device [ 1346.322882][ T5754] loop0: rw=2049, want=13809, limit=128 [ 1346.333299][ T5754] attempt to access beyond end of device [ 1346.339024][ T5754] loop0: rw=2049, want=17809, limit=128 [ 1346.353415][ T5754] attempt to access beyond end of device 01:28:15 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x7ffffffc) 01:28:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:15 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:15 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00>\x00'}) 01:28:15 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) 01:28:15 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3a00, 0x4) [ 1346.359121][ T5754] loop0: rw=2049, want=25985, limit=128 [ 1346.370235][ T5754] attempt to access beyond end of device [ 1346.375868][ T5754] loop0: rw=2049, want=27793, limit=128 01:28:15 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000800100"}) 01:28:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1346.548179][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1346.553993][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1346.628197][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1346.634054][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:28:15 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1346.708213][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1346.714076][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:28:15 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:15 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000300"}) 01:28:15 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1348.047592][ T5812] attempt to access beyond end of device [ 1348.053284][ T5812] loop0: rw=2049, want=130, limit=128 [ 1348.058760][ T5812] attempt to access beyond end of device [ 1348.064412][ T5812] loop0: rw=2049, want=131, limit=128 [ 1348.069866][ T5812] attempt to access beyond end of device [ 1348.069879][ T5812] loop0: rw=2049, want=132, limit=128 [ 1348.069914][ T5812] attempt to access beyond end of device [ 1348.069929][ T5812] loop0: rw=2049, want=133, limit=128 [ 1348.081004][ T5812] attempt to access beyond end of device [ 1348.097775][ T5812] loop0: rw=2049, want=142, limit=128 [ 1348.104208][ T5812] attempt to access beyond end of device [ 1348.109939][ T5812] loop0: rw=2049, want=143, limit=128 [ 1348.115359][ T5812] attempt to access beyond end of device [ 1348.121090][ T5812] loop0: rw=2049, want=144, limit=128 [ 1348.126509][ T5812] attempt to access beyond end of device [ 1348.132234][ T5812] loop0: rw=2049, want=145, limit=128 [ 1348.140927][ T5812] attempt to access beyond end of device [ 1348.146729][ T5812] loop0: rw=2049, want=2193, limit=128 [ 1348.155685][ T5812] attempt to access beyond end of device [ 1348.161436][ T5812] loop0: rw=2049, want=4345, limit=128 [ 1348.173624][ T5812] attempt to access beyond end of device [ 1348.179348][ T5812] loop0: rw=2049, want=7945, limit=128 [ 1348.190598][ T5812] attempt to access beyond end of device [ 1348.196247][ T5812] loop0: rw=2049, want=11465, limit=128 [ 1348.205284][ T5812] attempt to access beyond end of device [ 1348.210950][ T5812] loop0: rw=2049, want=13537, limit=128 [ 1348.220571][ T5812] attempt to access beyond end of device [ 1348.226244][ T5812] loop0: rw=2049, want=15833, limit=128 [ 1348.237225][ T5812] attempt to access beyond end of device [ 1348.243095][ T5812] loop0: rw=2049, want=19753, limit=128 [ 1348.260734][ T5812] attempt to access beyond end of device [ 1348.266375][ T5812] loop0: rw=2049, want=27497, limit=128 [ 1348.283274][ T5812] attempt to access beyond end of device [ 1348.288986][ T5812] loop0: rw=2049, want=32881, limit=128 [ 1348.302425][ T5817] attempt to access beyond end of device [ 1348.309404][ T5817] loop0: rw=2049, want=130, limit=128 [ 1348.314858][ T5817] attempt to access beyond end of device [ 1348.320578][ T5817] loop0: rw=2049, want=131, limit=128 [ 1348.325983][ T5817] attempt to access beyond end of device [ 1348.331670][ T5817] loop0: rw=2049, want=132, limit=128 [ 1348.337070][ T5817] attempt to access beyond end of device [ 1348.342775][ T5817] loop0: rw=2049, want=133, limit=128 [ 1348.348252][ T5817] attempt to access beyond end of device [ 1348.353880][ T5817] loop0: rw=2049, want=142, limit=128 01:28:17 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0xffffffffffffffff) 01:28:17 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000500"}) 01:28:17 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:17 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc01456b8, &(0x7f0000000180)={0x0, {0x687, 0x2000000}}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r1, 0x800442d3, &(0x7f0000000040)={0x0, 0xffff, 0x8, @local, 'batadv0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r2) 01:28:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3d00, 0x4) [ 1348.360372][ T5817] attempt to access beyond end of device [ 1348.366007][ T5817] loop0: rw=2049, want=143, limit=128 [ 1348.371878][ T5817] attempt to access beyond end of device [ 1348.377506][ T5817] loop0: rw=2049, want=144, limit=128 [ 1348.382970][ T5817] attempt to access beyond end of device [ 1348.388726][ T5817] loop0: rw=2049, want=145, limit=128 01:28:17 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:17 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:17 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000600"}) [ 1348.570852][ T5837] attempt to access beyond end of device [ 1348.721710][ T5837] loop5: rw=1, want=130, limit=128 [ 1348.743049][ T5837] attempt to access beyond end of device [ 1348.800082][ T5837] loop5: rw=1, want=131, limit=128 01:28:17 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\a\x00'}) [ 1348.834705][ T5837] attempt to access beyond end of device [ 1348.866959][ T5837] loop5: rw=1, want=132, limit=128 01:28:17 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:17 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1348.912581][ T5837] buffer_io_error: 32 callbacks suppressed [ 1348.912594][ T5837] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1349.047802][ T5837] attempt to access beyond end of device [ 1349.128170][ T5837] loop5: rw=1, want=133, limit=128 [ 1349.173977][ T5837] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1349.216345][ T5837] attempt to access beyond end of device [ 1349.257937][ T5837] loop5: rw=1, want=142, limit=128 [ 1349.296698][ T5837] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1349.354041][ T5837] attempt to access beyond end of device [ 1349.367999][ T5837] loop5: rw=1, want=143, limit=128 [ 1349.374586][ T5832] attempt to access beyond end of device [ 1349.380672][ T5837] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1349.389709][ T5832] loop5: rw=2049, want=3505, limit=128 [ 1349.399611][ T5837] attempt to access beyond end of device [ 1349.412241][ T5832] attempt to access beyond end of device [ 1349.416169][ T5837] loop5: rw=1, want=144, limit=128 [ 1349.417896][ T5832] loop5: rw=2049, want=5033, limit=128 [ 1349.429648][ T5837] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1349.438367][ T5837] attempt to access beyond end of device [ 1349.444005][ T5837] loop5: rw=1, want=145, limit=128 [ 1349.449228][ T5837] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1350.129069][ T5867] attempt to access beyond end of device [ 1350.134789][ T5867] loop0: rw=2049, want=130, limit=128 [ 1350.140198][ T5867] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1350.148805][ T5867] attempt to access beyond end of device [ 1350.158409][ T5867] loop0: rw=2049, want=131, limit=128 [ 1350.163799][ T5867] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1350.172386][ T5867] attempt to access beyond end of device [ 1350.178019][ T5867] loop0: rw=2049, want=132, limit=128 [ 1350.183481][ T5867] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1350.192071][ T5867] attempt to access beyond end of device [ 1350.197708][ T5867] loop0: rw=2049, want=133, limit=128 [ 1350.203129][ T5867] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1350.211894][ T5867] attempt to access beyond end of device [ 1350.217525][ T5867] loop0: rw=2049, want=142, limit=128 [ 1350.223624][ T5867] attempt to access beyond end of device [ 1350.229400][ T5867] loop0: rw=2049, want=143, limit=128 [ 1350.234938][ T5867] attempt to access beyond end of device [ 1350.240665][ T5867] loop0: rw=2049, want=144, limit=128 [ 1350.246068][ T5867] attempt to access beyond end of device [ 1350.251765][ T5867] loop0: rw=2049, want=145, limit=128 [ 1350.259681][ T5867] attempt to access beyond end of device [ 1350.265306][ T5867] loop0: rw=2049, want=2193, limit=128 [ 1350.275158][ T5867] attempt to access beyond end of device [ 1350.280815][ T5867] loop0: rw=2049, want=4241, limit=128 [ 1350.290055][ T5867] attempt to access beyond end of device [ 1350.295705][ T5867] loop0: rw=2049, want=6337, limit=128 [ 1350.308302][ T5867] attempt to access beyond end of device [ 1350.313973][ T5867] loop0: rw=2049, want=10433, limit=128 [ 1350.329978][ T5867] attempt to access beyond end of device [ 1350.335648][ T5867] loop0: rw=2049, want=14529, limit=128 [ 1350.357247][ T5867] attempt to access beyond end of device [ 1350.362981][ T5867] loop0: rw=2049, want=22545, limit=128 [ 1350.390048][ T5867] attempt to access beyond end of device [ 1350.395698][ T5867] loop0: rw=2049, want=32881, limit=128 [ 1350.407646][ T5870] attempt to access beyond end of device [ 1350.413408][ T5870] loop0: rw=2049, want=130, limit=128 [ 1350.418928][ T5870] attempt to access beyond end of device [ 1350.424635][ T5870] loop0: rw=2049, want=131, limit=128 [ 1350.430123][ T5870] attempt to access beyond end of device [ 1350.435798][ T5870] loop0: rw=2049, want=132, limit=128 [ 1350.442150][ T5870] attempt to access beyond end of device [ 1350.447792][ T5870] loop0: rw=2049, want=133, limit=128 [ 1350.453275][ T5870] attempt to access beyond end of device [ 1350.458968][ T5870] loop0: rw=2049, want=142, limit=128 [ 1350.464369][ T5870] attempt to access beyond end of device [ 1350.470103][ T5870] loop0: rw=2049, want=143, limit=128 [ 1350.475500][ T5870] attempt to access beyond end of device [ 1350.481219][ T5870] loop0: rw=2049, want=144, limit=128 01:28:19 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$void(r0, 0xc0045878) lsetxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB="00fbc90402fec51092a22cd2fd57ebc8ae573097f71499c7f112cc928dcedda7e1e18168c4894ebaf13c00000000c3260f83be7d448bfb2c472e21a206862b1922f4eb94ef25613f058edb8bb7687e5f8ef4751651f27a341f3818d573dd5e53ef23da3d48fb3f92a0cf349699808f7c5ade1fb59d356c235d54a1d0917208959670396088171114c8a61b5f657c01b7ff9552e468d7c77c235c3047edccbadbcc1ab8f15653ee0d81dad3c1e43bb6ac0bd54bcfe2070f495c4e9cf6a6d469a49ed9aea5a02f7139b2821d068ae4602ef90d77e35f24be3fbd985ae94d8b3dd1a10ddab3f4cc732f1319940102726a90bdca428eae6f30ea71078147ef3915e0cc9a8cf0402578cd907104a38a2f56b90e70d7b8536a34764748a02f1e15450e1bf0c2b57db06f6812b45701dc7fed2fc7ad5c7086d0aa2ee841ec1d6ede196e4234aa5688f207c61a3d21bb50e96c85430bfd990adfb691fd4d153d3308f9a68f3a959e7f173245"], 0xc9, 0x3) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000380)={{0x1e, @multicast2, 0x4e20, 0x0, 'sed\x00', 0x32, 0x1, 0x68}, {@multicast2, 0x4e22, 0x2000, 0x8001, 0x80000001, 0x2}}, 0x44) 01:28:19 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r1, r3, r4) [ 1350.486610][ T5870] attempt to access beyond end of device [ 1350.492277][ T5870] loop0: rw=2049, want=145, limit=128 [ 1350.499434][ T5870] attempt to access beyond end of device [ 1350.505083][ T5870] loop0: rw=2049, want=1329, limit=128 01:28:19 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3f00, 0x4) 01:28:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00>\x00'}) 01:28:19 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, 0x0) dup2(r3, 0xffffffffffffffff) 01:28:19 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:19 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, 0x0) dup2(r3, 0xffffffffffffffff) 01:28:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00?\x00'}) [ 1350.788171][ C0] net_ratelimit: 19 callbacks suppressed [ 1350.788179][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1350.798308][ T5888] attempt to access beyond end of device [ 1350.799663][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1350.808148][ T5888] loop5: rw=1, want=130, limit=128 [ 1350.830053][ T5888] attempt to access beyond end of device 01:28:19 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r0) [ 1350.868219][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1350.874032][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1350.879925][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1350.885702][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1350.900808][ T5888] loop5: rw=1, want=131, limit=128 [ 1350.916613][ T5888] attempt to access beyond end of device 01:28:19 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, 0x0) dup2(r3, 0xffffffffffffffff) [ 1350.967132][ T5888] loop5: rw=1, want=132, limit=128 01:28:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00@\x00'}) [ 1351.063569][ T5888] attempt to access beyond end of device 01:28:19 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x0, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1351.163199][ T5888] loop5: rw=1, want=133, limit=128 [ 1351.251996][ T5888] attempt to access beyond end of device [ 1351.309140][ T5888] loop5: rw=1, want=142, limit=128 [ 1351.371923][ T5888] attempt to access beyond end of device [ 1351.441039][ T5888] loop5: rw=1, want=143, limit=128 [ 1351.478270][ T5888] attempt to access beyond end of device [ 1351.495668][ T5888] loop5: rw=1, want=144, limit=128 [ 1351.530210][ T5888] attempt to access beyond end of device [ 1351.535957][ T5888] loop5: rw=1, want=145, limit=128 [ 1351.554647][ T5879] attempt to access beyond end of device [ 1351.565855][ T5879] loop5: rw=2049, want=3457, limit=128 [ 1351.762857][ T5921] attempt to access beyond end of device [ 1351.772397][ T5921] loop0: rw=1, want=130, limit=128 [ 1351.781450][ T5921] attempt to access beyond end of device [ 1351.787205][ T5921] loop0: rw=1, want=131, limit=128 [ 1351.796146][ T5921] attempt to access beyond end of device [ 1351.802787][ T5921] loop0: rw=1, want=132, limit=128 [ 1351.809435][ T5922] IPVS: set_ctl: invalid protocol: 30 224.0.0.2:20000 [ 1351.816938][ T5921] attempt to access beyond end of device [ 1351.823568][ T5921] loop0: rw=1, want=133, limit=128 [ 1351.830433][ T5921] attempt to access beyond end of device [ 1351.836326][ T5921] loop0: rw=1, want=142, limit=128 [ 1351.842126][ T5921] attempt to access beyond end of device [ 1351.848019][ T5921] loop0: rw=1, want=143, limit=128 [ 1351.854420][ T5921] attempt to access beyond end of device [ 1351.860905][ T5921] loop0: rw=1, want=144, limit=128 [ 1351.866622][ T5921] attempt to access beyond end of device [ 1351.898951][ T5921] loop0: rw=1, want=145, limit=128 [ 1351.988148][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1351.988574][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1351.993970][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1351.999981][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1352.042327][ T5921] attempt to access beyond end of device [ 1352.054802][ T5921] loop0: rw=1, want=3305, limit=128 [ 1352.163109][ T5921] attempt to access beyond end of device [ 1352.175550][ T5921] loop0: rw=1, want=5353, limit=128 [ 1352.265031][ T5921] attempt to access beyond end of device [ 1352.277442][ T5921] loop0: rw=1, want=7401, limit=128 [ 1352.366888][ T5921] attempt to access beyond end of device [ 1352.379844][ T5921] loop0: rw=1, want=9449, limit=128 [ 1352.425074][ T5921] attempt to access beyond end of device [ 1352.437442][ T5921] loop0: rw=1, want=13345, limit=128 [ 1352.460170][ T5921] attempt to access beyond end of device [ 1352.467930][ T5921] loop0: rw=1, want=17441, limit=128 [ 1352.481562][ T5921] attempt to access beyond end of device [ 1352.487287][ T5921] loop0: rw=1, want=17529, limit=128 [ 1352.498219][ T5918] attempt to access beyond end of device [ 1352.503899][ T5918] loop0: rw=2049, want=17913, limit=128 [ 1352.514507][ T5918] attempt to access beyond end of device [ 1352.514539][ T5921] attempt to access beyond end of device [ 1352.520561][ T5918] loop0: rw=2049, want=20505, limit=128 [ 1352.526890][ T5921] loop0: rw=1, want=18529, limit=128 01:28:21 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) chdir(&(0x7f0000000000)='./bus\x00') write$UHID_INPUT(0xffffffffffffffff, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x7e, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x2e79162758d7a0f7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x4) 01:28:21 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x0, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:21 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000ff00"}) 01:28:21 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x4000, 0x4) 01:28:21 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r1, r3, r4) 01:28:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r0) 01:28:21 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000100"}) [ 1352.778739][ T5942] attempt to access beyond end of device [ 1352.795634][ T5942] loop5: rw=1, want=130, limit=128 01:28:21 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x0, 0x2, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1352.828286][ T5942] attempt to access beyond end of device [ 1352.947555][ T5942] loop5: rw=1, want=131, limit=128 [ 1353.007784][ T5942] attempt to access beyond end of device [ 1353.036367][ T5942] loop5: rw=1, want=132, limit=128 01:28:21 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000800100"}) [ 1353.123881][ T5942] attempt to access beyond end of device 01:28:21 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x0, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:21 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) write$FUSE_NOTIFY_DELETE(r2, &(0x7f0000000000)={0x3f, 0x6, 0x0, {0x2, 0x6, 0x16, 0x0, 'posix_acl_access+eth0l'}}, 0x3f) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000080)={0x0, 0xb88, 0x2, 0x401, 0x6, "a4c51942eedd48a7"}) fadvise64(r0, 0x0, 0x0, 0x4) [ 1353.195566][ T5942] loop5: rw=1, want=133, limit=128 [ 1353.256774][ T5942] attempt to access beyond end of device [ 1353.274558][ T5942] loop5: rw=1, want=142, limit=128 01:28:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000200"}) [ 1353.369768][ T5942] attempt to access beyond end of device 01:28:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000300"}) [ 1353.498264][ T5942] loop5: rw=1, want=143, limit=128 [ 1353.513743][ T5942] attempt to access beyond end of device [ 1353.527947][ T5971] attempt to access beyond end of device 01:28:22 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r0) [ 1353.557407][ T5971] loop0: rw=1, want=130, limit=128 01:28:22 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x0, 0x0, 0xffffffffffffffff}) dup2(r3, r4) [ 1353.613229][ T5942] loop5: rw=1, want=144, limit=128 [ 1353.640465][ T5935] attempt to access beyond end of device [ 1353.644689][ T5942] attempt to access beyond end of device [ 1353.649319][ T5971] attempt to access beyond end of device [ 1353.686214][ T5942] loop5: rw=1, want=145, limit=128 [ 1353.737353][ T5971] loop0: rw=1, want=131, limit=128 [ 1353.765493][ T5935] loop5: rw=2049, want=2449, limit=128 [ 1353.802302][ T5935] attempt to access beyond end of device [ 1353.818933][ T5971] attempt to access beyond end of device [ 1353.825870][ T5935] loop5: rw=2049, want=3513, limit=128 [ 1353.855941][ T5971] loop0: rw=1, want=132, limit=128 01:28:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x4800, 0x4) 01:28:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000400"}) 01:28:22 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x0, 0x0, 0xffffffffffffffff}) dup2(r3, r4) 01:28:22 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r1, r3, r4) [ 1353.927478][ T5971] buffer_io_error: 38 callbacks suppressed [ 1353.927524][ T5971] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1353.946101][ T5971] attempt to access beyond end of device [ 1353.952416][ T5971] loop0: rw=1, want=133, limit=128 [ 1353.963644][ T5971] Buffer I/O error on dev loop0, logical block 132, lost async page write 01:28:22 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(0xffffffffffffffff, r4) [ 1354.040469][ T5971] attempt to access beyond end of device 01:28:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000500"}) [ 1354.091456][ T5971] loop0: rw=1, want=142, limit=128 01:28:22 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(0xffffffffffffffff, r4) [ 1354.130960][ T5971] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1354.328994][ T5971] attempt to access beyond end of device [ 1354.335905][ T5971] loop0: rw=1, want=143, limit=128 [ 1354.343303][ T5971] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1354.352012][ T5971] attempt to access beyond end of device [ 1354.365508][ T5971] loop0: rw=1, want=144, limit=128 [ 1354.378023][ T5971] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1354.387066][ T5971] attempt to access beyond end of device [ 1354.398980][ T5971] loop0: rw=1, want=145, limit=128 [ 1354.407865][ T5971] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1354.429200][ T6015] attempt to access beyond end of device [ 1354.436669][ T5971] attempt to access beyond end of device [ 1354.442610][ T5971] loop0: rw=1, want=4113, limit=128 [ 1354.460348][ T5971] attempt to access beyond end of device [ 1354.462971][ T5964] attempt to access beyond end of device [ 1354.472202][ T5971] loop0: rw=1, want=5369, limit=128 [ 1354.487437][ T6015] loop5: rw=1, want=130, limit=128 [ 1354.522930][ T5964] loop0: rw=2049, want=2065, limit=128 [ 1354.538853][ T6015] Buffer I/O error on dev loop5, logical block 129, lost async page write 01:28:23 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x622, 0x80, 0x8, 0x1}, {0x800, 0xfd, 0xf7, 0xfffffffd}]}) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x400000, 0x0) ioctl$NS_GET_PARENT(r1, 0xb702, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000000c0)='tls\x00', 0x4) 01:28:23 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000600"}) 01:28:23 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2, 0x0, 0xffffffffffffffff}) dup2(0xffffffffffffffff, r4) 01:28:23 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1354.627385][ T6015] attempt to access beyond end of device [ 1354.657765][ T6015] loop5: rw=1, want=131, limit=128 [ 1354.664269][ T6015] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1354.695608][ T6015] attempt to access beyond end of device [ 1354.701770][ T6015] loop5: rw=1, want=132, limit=128 [ 1354.707893][ T6015] Buffer I/O error on dev loop5, logical block 131, lost async page write 01:28:23 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2}) dup2(r3, 0xffffffffffffffff) [ 1354.860293][ T6015] attempt to access beyond end of device [ 1354.907478][ T6015] loop5: rw=1, want=133, limit=128 [ 1354.970527][ T6015] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1355.018338][ T6032] FAT-fs (loop0): bogus number of reserved sectors [ 1355.037105][ T6015] attempt to access beyond end of device [ 1355.062876][ T6015] loop5: rw=1, want=142, limit=128 [ 1355.083173][ T6032] FAT-fs (loop0): Can't find a valid FAT filesystem [ 1355.089379][ T6015] attempt to access beyond end of device [ 1355.095555][ T6015] loop5: rw=1, want=143, limit=128 [ 1355.101492][ T6015] attempt to access beyond end of device [ 1355.144087][ T6015] loop5: rw=1, want=144, limit=128 [ 1355.154344][ T6015] attempt to access beyond end of device [ 1355.172944][ T6015] loop5: rw=1, want=145, limit=128 [ 1355.183192][ T6015] attempt to access beyond end of device [ 1355.205032][ T6015] loop5: rw=1, want=169, limit=128 [ 1355.208695][ T6005] attempt to access beyond end of device [ 1355.241545][ T6005] loop5: rw=2049, want=2217, limit=128 [ 1355.263223][ T6005] attempt to access beyond end of device [ 1355.280849][ T6005] loop5: rw=2049, want=4265, limit=128 [ 1355.297610][ T6005] attempt to access beyond end of device [ 1355.318456][ T6005] loop5: rw=2049, want=4529, limit=128 01:28:24 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x4c00, 0x4) 01:28:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:24 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:24 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2}) dup2(r3, 0xffffffffffffffff) 01:28:24 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r1, r3, r4) 01:28:24 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f0000000200)={0x5ca, 0x2}) dup2(r3, 0xffffffffffffffff) 01:28:24 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1355.840994][ T6032] FAT-fs (loop0): bogus number of reserved sectors [ 1355.873461][ T6032] FAT-fs (loop0): Can't find a valid FAT filesystem [ 1355.923098][ T6075] attempt to access beyond end of device [ 1355.974814][ T6075] loop5: rw=1, want=130, limit=128 [ 1355.981390][ T6075] attempt to access beyond end of device [ 1356.014990][ T6075] loop5: rw=1, want=131, limit=128 01:28:24 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') write$UHID_INPUT(0xffffffffffffffff, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x4) 01:28:24 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:24 executing program 4: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2000000012005ff3fdb2e933004aa0008000"/32, 0x20) 01:28:24 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1356.038894][ T6075] attempt to access beyond end of device [ 1356.074498][ T6075] loop5: rw=1, want=132, limit=128 [ 1356.095283][ T6075] attempt to access beyond end of device 01:28:24 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1356.135638][ T6075] loop5: rw=1, want=133, limit=128 [ 1356.146990][ T6075] attempt to access beyond end of device [ 1356.148683][ C0] net_ratelimit: 20 callbacks suppressed [ 1356.148702][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1356.152817][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1356.158678][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1356.164116][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1356.207598][ T6075] loop5: rw=1, want=142, limit=128 [ 1356.297589][ T6075] attempt to access beyond end of device [ 1356.389756][ T6075] loop5: rw=1, want=143, limit=128 [ 1356.395113][ T6075] attempt to access beyond end of device [ 1356.400937][ T6075] loop5: rw=1, want=144, limit=128 [ 1356.406176][ T6075] attempt to access beyond end of device [ 1356.412189][ T6075] loop5: rw=1, want=145, limit=128 [ 1356.417485][ T6075] attempt to access beyond end of device [ 1356.423428][ T6075] loop5: rw=1, want=169, limit=128 [ 1356.625296][ T6065] attempt to access beyond end of device [ 1356.631274][ T6065] loop5: rw=2049, want=2729, limit=128 [ 1356.644147][ T6065] attempt to access beyond end of device [ 1356.664418][ T6065] loop5: rw=2049, want=4825, limit=128 01:28:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x6000, 0x4) 01:28:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0x1) r0 = io_uring_setup(0xa4, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000280)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x40000000000000a1) io_uring_register$IORING_UNREGISTER_FILES(r0, 0x3, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x302, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) socketpair(0x1e, 0x80005, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180), 0x127) r1 = socket(0x10, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f000095dff8), 0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(0xffffffffffffffff, 0x84, 0x23, 0x0, 0x0) socket$kcm(0xa, 0x5, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000280)) 01:28:25 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:28:25 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:25 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') statx(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0xb9c9170cce24dbff, &(0x7f0000000300)) setxattr$security_evm(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@sha1={0x1, "4608aa168199f003d9ed2b3e81143abf6d567837"}, 0x15, 0x2) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x80000, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f00000001c0)={0x3, {{0x2, 0x4e22, @empty}}}, 0x88) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0xfd, 0x0, 0x0, 0xfc, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9}}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x9) fadvise64(r0, 0x0, 0x0, 0x4) 01:28:25 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)) [ 1356.675295][ T6065] attempt to access beyond end of device [ 1356.681716][ T6065] loop5: rw=2049, want=7041, limit=128 [ 1356.691241][ T6065] attempt to access beyond end of device [ 1356.696900][ T6065] loop5: rw=2049, want=8225, limit=128 01:28:25 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000fffffdfd00"}) 01:28:25 executing program 1: r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1356.948183][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1356.954000][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1357.021250][ T6161] attempt to access beyond end of device [ 1357.028168][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1357.033955][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1357.104449][ T6161] loop0: rw=1, want=130, limit=128 [ 1357.108265][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1357.115396][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:28:25 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip_vs\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000080)='comm\x00') openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000340)='cgroup.subtree_control\x00', 0x2, 0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, 0xffffffffffffffff) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000000c0)) openat$full(0xffffffffffffff9c, 0x0, 0x2f240, 0x0) r2 = syz_open_dev$amidi(0x0, 0x9c4, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)}}, 0x20) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[], 0x1de}}, 0x0) waitid(0x83b895581628fca4, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000480)) r3 = gettid() r4 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r4, 0x227d, &(0x7f0000000780)) kcmp(0x0, 0x0, 0x0, r2, r4) ptrace$setopts(0x4206, r3, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x5, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100), 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0xc) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0xa0000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0xb0ddd38a6cfd4e8a) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r5, &(0x7f0000000100)=ANY=[@ANYRESHEX], 0xffe8) socket(0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000005c0)={0x0, @in6={{0xa, 0x4e22, 0xe39, @local}}, [0x9, 0x100, 0x0, 0x1, 0x3, 0x9, 0x10001, 0x0, 0x0, 0x7f, 0x40, 0x7fff, 0x0, 0x4]}, 0x0) sendfile(r1, r0, 0x0, 0x20080000000) [ 1357.214384][ T6235] attempt to access beyond end of device [ 1357.227787][ T6235] loop5: rw=1, want=130, limit=128 [ 1357.238387][ T6235] attempt to access beyond end of device [ 1357.244055][ T6235] loop5: rw=1, want=131, limit=128 [ 1357.249631][ T6161] attempt to access beyond end of device [ 1357.252459][ T6235] attempt to access beyond end of device 01:28:26 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000ff00"}) [ 1357.261114][ T6235] loop5: rw=1, want=132, limit=128 [ 1357.266420][ T6235] attempt to access beyond end of device [ 1357.277757][ T6235] loop5: rw=1, want=133, limit=128 [ 1357.290873][ T6235] attempt to access beyond end of device [ 1357.302665][ T6235] loop5: rw=1, want=142, limit=128 [ 1357.338492][ T6235] attempt to access beyond end of device [ 1357.357872][ T6161] loop0: rw=1, want=131, limit=128 [ 1357.383965][ T6161] attempt to access beyond end of device [ 1357.416911][ T6235] loop5: rw=1, want=143, limit=128 [ 1357.450613][ T6161] loop0: rw=1, want=132, limit=128 [ 1357.476367][ T6235] attempt to access beyond end of device [ 1357.498271][ T6161] attempt to access beyond end of device [ 1357.538254][ T6161] loop0: rw=1, want=133, limit=128 [ 1357.543582][ T6235] loop5: rw=1, want=144, limit=128 [ 1357.571379][ T6235] attempt to access beyond end of device 01:28:26 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000fdfdffff00"}) [ 1357.593517][ T6161] attempt to access beyond end of device [ 1357.594769][ T6235] loop5: rw=1, want=145, limit=128 [ 1357.615501][ T6235] attempt to access beyond end of device [ 1357.655964][ T6235] loop5: rw=1, want=177, limit=128 [ 1357.691250][ T6161] loop0: rw=1, want=142, limit=128 01:28:26 executing program 4: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000100)={'IDLETIMER\x00'}, &(0x7f0000000140)=0x1e) [ 1357.750314][ T6110] attempt to access beyond end of device [ 1357.768225][ T6161] attempt to access beyond end of device [ 1357.783214][ T6110] loop0: rw=2049, want=2193, limit=128 [ 1357.805118][ T6161] loop0: rw=1, want=143, limit=128 [ 1357.827889][ T6110] attempt to access beyond end of device [ 1357.831831][ T6161] attempt to access beyond end of device [ 1357.869222][ T6110] loop0: rw=2049, want=2217, limit=128 [ 1357.895632][ T6161] loop0: rw=1, want=144, limit=128 [ 1357.946028][ T6161] attempt to access beyond end of device [ 1358.008231][ T6161] loop0: rw=1, want=145, limit=128 [ 1358.043361][ T6231] attempt to access beyond end of device [ 1358.058504][ T6231] loop5: rw=2049, want=2225, limit=128 [ 1358.080644][ T6231] attempt to access beyond end of device [ 1358.086322][ T6231] loop5: rw=2049, want=4729, limit=128 01:28:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x6800, 0x4) 01:28:26 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000100"}) 01:28:26 executing program 1: r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:26 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clock_adjtime(0x0, &(0x7f0000000200)) 01:28:26 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) 01:28:26 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$unix(r0, &(0x7f0000000000)=@file={0x1, './bus\x00'}, 0x6e) [ 1358.099354][ T6231] attempt to access beyond end of device [ 1358.105109][ T6231] loop5: rw=2049, want=5921, limit=128 01:28:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000800100"}) 01:28:27 executing program 4: 01:28:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000200"}) 01:28:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000300"}) 01:28:27 executing program 4: 01:28:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000400"}) [ 1358.915616][ T6498] attempt to access beyond end of device [ 1358.954443][ T6498] loop5: rw=1, want=130, limit=128 [ 1358.980689][ T6498] buffer_io_error: 28 callbacks suppressed [ 1358.980700][ T6498] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1359.133670][ T6498] attempt to access beyond end of device [ 1359.157255][ T6450] attempt to access beyond end of device [ 1359.169909][ T6498] loop5: rw=1, want=131, limit=128 [ 1359.175064][ T6498] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1359.197863][ T6450] loop0: rw=2049, want=130, limit=128 [ 1359.203578][ T6450] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1359.218846][ T6450] attempt to access beyond end of device [ 1359.224517][ T6450] loop0: rw=2049, want=131, limit=128 [ 1359.235722][ T6450] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1359.245495][ T6498] attempt to access beyond end of device [ 1359.256488][ T6450] attempt to access beyond end of device [ 1359.264245][ T6450] loop0: rw=2049, want=132, limit=128 [ 1359.275032][ T6450] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1359.284684][ T6498] loop5: rw=1, want=132, limit=128 [ 1359.295162][ T6450] attempt to access beyond end of device [ 1359.298790][ T6498] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1359.301799][ T6450] loop0: rw=2049, want=133, limit=128 [ 1359.318141][ T6450] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1359.322032][ T6498] attempt to access beyond end of device [ 1359.326669][ T6450] attempt to access beyond end of device [ 1359.326682][ T6450] loop0: rw=2049, want=142, limit=128 [ 1359.326698][ T6450] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1359.344023][ T6498] loop5: rw=1, want=133, limit=128 [ 1359.357449][ T6450] attempt to access beyond end of device [ 1359.363236][ T6450] loop0: rw=2049, want=143, limit=128 [ 1359.369755][ T6450] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1359.374597][ T6498] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1359.378426][ T6450] attempt to access beyond end of device [ 1359.392636][ T6450] loop0: rw=2049, want=144, limit=128 [ 1359.396959][ T6498] attempt to access beyond end of device [ 1359.398142][ T6450] attempt to access beyond end of device [ 1359.409590][ T6450] loop0: rw=2049, want=145, limit=128 [ 1359.418602][ T6498] loop5: rw=1, want=142, limit=128 [ 1359.418741][ T6450] attempt to access beyond end of device [ 1359.429535][ T6498] attempt to access beyond end of device [ 1359.435174][ T6498] loop5: rw=1, want=143, limit=128 [ 1359.440388][ T6450] loop0: rw=2049, want=2209, limit=128 [ 1359.451257][ T6450] attempt to access beyond end of device [ 1359.456987][ T6450] loop0: rw=2049, want=4257, limit=128 [ 1359.464376][ T6450] attempt to access beyond end of device [ 1359.470142][ T6498] attempt to access beyond end of device [ 1359.475779][ T6498] loop5: rw=1, want=144, limit=128 [ 1359.481833][ T6450] loop0: rw=2049, want=4377, limit=128 [ 1359.487646][ T6498] attempt to access beyond end of device [ 1359.517621][ T6498] loop5: rw=1, want=145, limit=128 [ 1359.554433][ T6498] attempt to access beyond end of device [ 1359.576098][ T6498] loop5: rw=1, want=185, limit=128 [ 1359.667534][ T6493] attempt to access beyond end of device [ 1359.674159][ T6493] loop5: rw=2049, want=2257, limit=128 [ 1359.694906][ T6493] attempt to access beyond end of device [ 1359.701647][ T6493] loop5: rw=2049, want=6185, limit=128 [ 1359.716585][ T6493] attempt to access beyond end of device [ 1359.722690][ T6493] loop5: rw=2049, want=10289, limit=128 [ 1359.735138][ T6493] attempt to access beyond end of device [ 1359.740835][ T6493] loop5: rw=2049, want=13793, limit=128 [ 1359.750896][ T6493] attempt to access beyond end of device [ 1359.756540][ T6493] loop5: rw=2049, want=15841, limit=128 01:28:28 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x6c00, 0x4) 01:28:28 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:28 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000500"}) 01:28:28 executing program 1: r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:28 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:28 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) accept4$bt_l2cap(r0, 0x0, &(0x7f0000000000), 0x800) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v1={0x1000000, [{0x1, 0x7fffffff}]}, 0xc, 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x5, 0x80, 0x0, 0x0, 0x0, 0x7f, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x18}, 0x6, 0x3, 0xfffffffe, 0x9}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1359.763476][ T6493] attempt to access beyond end of device [ 1359.769162][ T6493] loop5: rw=2049, want=16249, limit=128 01:28:28 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000600"}) [ 1359.994327][ T6528] attempt to access beyond end of device [ 1360.043442][ T6528] loop0: rw=1, want=130, limit=128 [ 1360.043489][ T6528] attempt to access beyond end of device [ 1360.043499][ T6528] loop0: rw=1, want=131, limit=128 [ 1360.043528][ T6528] attempt to access beyond end of device 01:28:28 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:28 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1360.158376][ T6528] loop0: rw=1, want=132, limit=128 [ 1360.202824][ T6528] attempt to access beyond end of device [ 1360.261576][ T6528] loop0: rw=1, want=133, limit=128 01:28:29 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1360.335523][ T6528] attempt to access beyond end of device [ 1360.399901][ T6528] loop0: rw=1, want=142, limit=128 [ 1360.459694][ T6528] attempt to access beyond end of device 01:28:29 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1360.518133][ T6528] loop0: rw=1, want=143, limit=128 01:28:29 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1360.580410][ T6528] attempt to access beyond end of device [ 1360.599958][ T6528] loop0: rw=1, want=144, limit=128 [ 1360.616950][ T6528] attempt to access beyond end of device [ 1360.668205][ T6528] loop0: rw=1, want=145, limit=128 [ 1360.752621][ T6528] attempt to access beyond end of device [ 1360.818999][ T6528] loop0: rw=1, want=769, limit=128 [ 1360.870470][ T6518] attempt to access beyond end of device [ 1360.933664][ T6518] loop0: rw=2049, want=2241, limit=128 [ 1360.993523][ T6528] attempt to access beyond end of device [ 1361.019541][ T6528] loop0: rw=1, want=2249, limit=128 [ 1361.037616][ T6528] attempt to access beyond end of device [ 1361.044572][ T6528] loop0: rw=1, want=4689, limit=128 [ 1361.052307][ T6518] attempt to access beyond end of device [ 1361.058008][ T6518] loop0: rw=2049, want=2449, limit=128 [ 1361.083691][ T6518] attempt to access beyond end of device [ 1361.105567][ T6528] attempt to access beyond end of device [ 1361.123624][ T6528] loop0: rw=1, want=4721, limit=128 [ 1361.135949][ T6518] loop0: rw=2049, want=5449, limit=128 [ 1361.188186][ C0] net_ratelimit: 19 callbacks suppressed [ 1361.188194][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1361.199666][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1361.268288][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1361.274125][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1361.280017][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1361.285786][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:28:30 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x7400, 0x4) 01:28:30 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:28:30 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:30 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:30 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000000)=@bpq0='bpq0\x00', 0x10) chdir(&(0x7f0000000180)='./file0\x00') r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) [ 1361.495475][ T27] audit: type=1800 audit(1577150910.233:82): pid=6554 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="sda1" ino=16546 res=0 01:28:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) [ 1361.746661][ T6583] attempt to access beyond end of device [ 1361.766145][ T6583] loop0: rw=1, want=130, limit=128 [ 1361.784171][ T6583] attempt to access beyond end of device 01:28:30 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1361.803892][ T6583] loop0: rw=1, want=131, limit=128 [ 1361.824016][ T6583] attempt to access beyond end of device 01:28:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000fffffdfd00"}) [ 1361.856149][ T6583] loop0: rw=1, want=132, limit=128 [ 1361.880294][ T6583] attempt to access beyond end of device [ 1361.906659][ T6583] loop0: rw=1, want=133, limit=128 [ 1361.939735][ T6583] attempt to access beyond end of device 01:28:30 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1361.991128][ T6583] loop0: rw=1, want=142, limit=128 [ 1362.040786][ T6583] attempt to access beyond end of device 01:28:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000ff00"}) [ 1362.115773][ T6583] loop0: rw=1, want=143, limit=128 [ 1362.173123][ T6583] attempt to access beyond end of device [ 1362.208493][ T6583] loop0: rw=1, want=144, limit=128 [ 1362.216466][ T6583] attempt to access beyond end of device [ 1362.223491][ T6583] loop0: rw=1, want=145, limit=128 01:28:31 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1362.312642][ T6601] attempt to access beyond end of device [ 1362.323094][ T6601] loop5: rw=1, want=130, limit=128 [ 1362.333034][ T6601] attempt to access beyond end of device [ 1362.344777][ T6601] loop5: rw=1, want=131, limit=128 [ 1362.349793][ T6583] attempt to access beyond end of device [ 1362.365434][ T6601] attempt to access beyond end of device [ 1362.388167][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1362.388210][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1362.393947][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1362.399722][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1362.421380][ T6583] loop0: rw=1, want=2201, limit=128 [ 1362.440910][ T6601] loop5: rw=1, want=132, limit=128 [ 1362.472338][ T6601] attempt to access beyond end of device [ 1362.566951][ T6583] attempt to access beyond end of device [ 1362.577455][ T6601] loop5: rw=1, want=133, limit=128 [ 1362.605956][ T6583] loop0: rw=1, want=4857, limit=128 [ 1362.614741][ T6601] attempt to access beyond end of device [ 1362.627975][ T6573] attempt to access beyond end of device [ 1362.649711][ T6583] attempt to access beyond end of device [ 1362.655450][ T6573] loop0: rw=2049, want=6465, limit=128 [ 1362.661160][ T6601] loop5: rw=1, want=142, limit=128 [ 1362.666361][ T6601] attempt to access beyond end of device [ 1362.686237][ T6583] loop0: rw=1, want=4865, limit=128 [ 1362.743136][ T6601] loop5: rw=1, want=143, limit=128 [ 1362.769164][ T6601] attempt to access beyond end of device [ 1362.774839][ T6601] loop5: rw=1, want=144, limit=128 [ 1362.808602][ T6601] attempt to access beyond end of device [ 1362.822758][ T6601] loop5: rw=1, want=145, limit=128 [ 1362.828741][ T6601] attempt to access beyond end of device [ 1362.834392][ T6601] loop5: rw=1, want=193, limit=128 [ 1363.022410][ T6595] attempt to access beyond end of device [ 1363.028200][ T6595] loop5: rw=2049, want=2353, limit=128 [ 1363.036789][ T6595] attempt to access beyond end of device [ 1363.042473][ T6595] loop5: rw=2049, want=4401, limit=128 [ 1363.052889][ T6595] attempt to access beyond end of device [ 1363.058600][ T6595] loop5: rw=2049, want=6457, limit=128 01:28:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x7a00, 0x4) 01:28:31 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:31 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000ffffffff00"}) 01:28:31 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:31 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:31 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) rename(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='./bus\x00') write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1363.067700][ T6595] attempt to access beyond end of device [ 1363.073398][ T6595] loop5: rw=2049, want=9601, limit=128 [ 1363.084468][ T6595] attempt to access beyond end of device [ 1363.091026][ T6595] loop5: rw=2049, want=13697, limit=128 [ 1363.098492][ T6595] attempt to access beyond end of device [ 1363.104128][ T6595] loop5: rw=2049, want=13721, limit=128 01:28:32 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:32 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000200"}) [ 1363.348318][ T6632] attempt to access beyond end of device [ 1363.428405][ T6632] loop0: rw=1, want=130, limit=128 [ 1363.529343][ T6632] attempt to access beyond end of device 01:28:32 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000300"}) [ 1363.609902][ T6632] loop0: rw=1, want=131, limit=128 01:28:32 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1363.676472][ T6632] attempt to access beyond end of device [ 1363.738331][ T6632] loop0: rw=1, want=132, limit=128 [ 1363.862779][ T6632] attempt to access beyond end of device 01:28:32 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000400"}) [ 1363.935934][ T6632] loop0: rw=1, want=133, limit=128 [ 1364.000796][ T6632] buffer_io_error: 33 callbacks suppressed [ 1364.000809][ T6632] Buffer I/O error on dev loop0, logical block 132, lost async page write 01:28:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1364.184495][ T6658] attempt to access beyond end of device [ 1364.195724][ T6623] attempt to access beyond end of device [ 1364.213564][ T6632] attempt to access beyond end of device [ 1364.219970][ T6632] loop0: rw=1, want=142, limit=128 [ 1364.225334][ T6632] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1364.229151][ T6658] loop5: rw=1, want=130, limit=128 [ 1364.234082][ T6632] attempt to access beyond end of device [ 1364.245149][ T6632] loop0: rw=1, want=143, limit=128 [ 1364.265485][ T6632] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1364.295449][ T6658] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1364.305419][ T6632] attempt to access beyond end of device [ 1364.332998][ T6632] loop0: rw=1, want=144, limit=128 [ 1364.346239][ T6623] loop0: rw=2049, want=2441, limit=128 [ 1364.363050][ T6632] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1364.385064][ T6632] attempt to access beyond end of device [ 1364.387287][ T6623] attempt to access beyond end of device [ 1364.394269][ T6632] loop0: rw=1, want=145, limit=128 [ 1364.396967][ T6658] attempt to access beyond end of device [ 1364.410522][ T6632] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1364.420639][ T6623] loop0: rw=2049, want=3113, limit=128 [ 1364.423424][ T6658] loop5: rw=1, want=131, limit=128 [ 1364.453087][ T6658] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1364.495196][ T6658] attempt to access beyond end of device [ 1364.501383][ T6658] loop5: rw=1, want=132, limit=128 [ 1364.519486][ T6658] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1364.528420][ T6658] attempt to access beyond end of device [ 1364.534442][ T6658] loop5: rw=1, want=133, limit=128 [ 1364.539876][ T6658] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1364.548657][ T6658] attempt to access beyond end of device [ 1364.554516][ T6658] loop5: rw=1, want=142, limit=128 [ 1364.559849][ T6658] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1364.568601][ T6658] attempt to access beyond end of device [ 1364.574378][ T6658] loop5: rw=1, want=143, limit=128 [ 1364.579795][ T6658] attempt to access beyond end of device [ 1364.585586][ T6658] loop5: rw=1, want=144, limit=128 [ 1364.591877][ T6658] attempt to access beyond end of device [ 1364.597821][ T6658] loop5: rw=1, want=145, limit=128 [ 1364.603884][ T6658] attempt to access beyond end of device [ 1364.610115][ T6658] loop5: rw=1, want=193, limit=128 [ 1364.935816][ T6650] attempt to access beyond end of device [ 1364.941566][ T6650] loop5: rw=2049, want=2265, limit=128 [ 1364.950944][ T6650] attempt to access beyond end of device [ 1364.956577][ T6650] loop5: rw=2049, want=4409, limit=128 [ 1364.969161][ T6650] attempt to access beyond end of device [ 1364.974794][ T6650] loop5: rw=2049, want=6457, limit=128 [ 1364.987431][ T6650] attempt to access beyond end of device [ 1364.993219][ T6650] loop5: rw=2049, want=9225, limit=128 [ 1365.007400][ T6650] attempt to access beyond end of device [ 1365.013956][ T6650] loop5: rw=2049, want=13337, limit=128 01:28:33 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x8800, 0x4) 01:28:33 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000500"}) 01:28:33 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:33 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) setsockopt$SO_J1939_SEND_PRIO(0xffffffffffffffff, 0x6b, 0x3, &(0x7f0000000000)=0x4, 0x4) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:28:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1365.032804][ T6650] attempt to access beyond end of device [ 1365.039185][ T6650] loop5: rw=2049, want=19993, limit=128 [ 1365.060685][ T6650] attempt to access beyond end of device [ 1365.066361][ T6650] loop5: rw=2049, want=21945, limit=128 01:28:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000600"}) 01:28:34 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:34 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1365.330693][ T6687] attempt to access beyond end of device [ 1365.405790][ T6687] loop0: rw=1, want=130, limit=128 01:28:34 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1365.448047][ T6687] attempt to access beyond end of device [ 1365.488409][ T6687] loop0: rw=1, want=131, limit=128 01:28:34 executing program 4: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1365.536747][ T6687] attempt to access beyond end of device [ 1365.586810][ T6687] loop0: rw=1, want=132, limit=128 01:28:34 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00>\x00'}) [ 1365.644785][ T6687] attempt to access beyond end of device [ 1365.663423][ T6687] loop0: rw=1, want=133, limit=128 [ 1365.721865][ T6687] attempt to access beyond end of device [ 1365.815654][ T6687] loop0: rw=1, want=142, limit=128 [ 1365.873006][ T6687] attempt to access beyond end of device [ 1365.940758][ T6687] loop0: rw=1, want=143, limit=128 [ 1365.965870][ T6687] attempt to access beyond end of device [ 1365.993703][ T6687] loop0: rw=1, want=144, limit=128 [ 1366.029035][ T6712] attempt to access beyond end of device [ 1366.035609][ T6687] attempt to access beyond end of device [ 1366.048114][ T6712] loop5: rw=1, want=130, limit=128 [ 1366.053416][ T6712] attempt to access beyond end of device [ 1366.059429][ T6712] loop5: rw=1, want=131, limit=128 [ 1366.064593][ T6712] attempt to access beyond end of device [ 1366.078144][ T6712] loop5: rw=1, want=132, limit=128 [ 1366.083304][ T6712] attempt to access beyond end of device [ 1366.089011][ T6712] loop5: rw=1, want=133, limit=128 [ 1366.089053][ T6712] attempt to access beyond end of device [ 1366.108133][ T6712] loop5: rw=1, want=142, limit=128 [ 1366.113647][ T6712] attempt to access beyond end of device [ 1366.150964][ T6687] loop0: rw=1, want=145, limit=128 [ 1366.158508][ T6712] loop5: rw=1, want=143, limit=128 [ 1366.163678][ T6712] attempt to access beyond end of device [ 1366.174237][ T6676] attempt to access beyond end of device [ 1366.179942][ T6712] loop5: rw=1, want=144, limit=128 [ 1366.179988][ T6712] attempt to access beyond end of device [ 1366.180000][ T6712] loop5: rw=1, want=145, limit=128 [ 1366.180130][ T6712] attempt to access beyond end of device [ 1366.185650][ T6676] loop0: rw=2049, want=3769, limit=128 [ 1366.215581][ T6712] loop5: rw=1, want=201, limit=128 [ 1366.222913][ T6687] attempt to access beyond end of device [ 1366.228668][ T6676] attempt to access beyond end of device [ 1366.234394][ T6676] loop0: rw=2049, want=3777, limit=128 [ 1366.240144][ T6687] loop0: rw=1, want=5409, limit=128 [ 1366.548231][ C0] net_ratelimit: 20 callbacks suppressed [ 1366.548239][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1366.558205][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1366.559732][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1366.565376][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1366.795263][ T6707] attempt to access beyond end of device [ 1366.801077][ T6707] loop5: rw=2049, want=2961, limit=128 [ 1366.810180][ T6707] attempt to access beyond end of device [ 1366.815823][ T6707] loop5: rw=2049, want=5041, limit=128 [ 1366.825523][ T6707] attempt to access beyond end of device [ 1366.831492][ T6707] loop5: rw=2049, want=7089, limit=128 [ 1366.843624][ T6707] attempt to access beyond end of device [ 1366.849844][ T6707] loop5: rw=2049, want=10841, limit=128 [ 1366.862526][ T6707] attempt to access beyond end of device [ 1366.868321][ T6707] loop5: rw=2049, want=14937, limit=128 [ 1366.885378][ T6707] attempt to access beyond end of device 01:28:35 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0xcf01, 0x4) 01:28:35 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:35 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000800100"}) 01:28:35 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:35 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:35 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1366.891074][ T6707] loop5: rw=2049, want=22393, limit=128 [ 1366.907902][ T6707] attempt to access beyond end of device [ 1366.913567][ T6707] loop5: rw=2049, want=28201, limit=128 01:28:35 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000300"}) 01:28:35 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1367.117298][ T6734] attempt to access beyond end of device [ 1367.201040][ T6734] loop0: rw=1, want=130, limit=128 01:28:36 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000500"}) [ 1367.236512][ T6734] attempt to access beyond end of device [ 1367.278895][ T6734] loop0: rw=1, want=131, limit=128 01:28:36 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1367.332024][ T6734] attempt to access beyond end of device [ 1367.348166][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1367.354023][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1367.394217][ T6734] loop0: rw=1, want=132, limit=128 [ 1367.428165][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1367.434030][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1367.447174][ T6734] attempt to access beyond end of device 01:28:36 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000600"}) 01:28:36 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) [ 1367.490693][ T6734] loop0: rw=1, want=133, limit=128 [ 1367.508216][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1367.514074][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1367.558526][ T6734] attempt to access beyond end of device [ 1367.622926][ T6734] loop0: rw=1, want=142, limit=128 [ 1367.674455][ T6734] attempt to access beyond end of device [ 1367.721683][ T6734] loop0: rw=1, want=143, limit=128 [ 1367.771177][ T6734] attempt to access beyond end of device [ 1367.776952][ T6734] loop0: rw=1, want=144, limit=128 [ 1367.819362][ T6734] attempt to access beyond end of device [ 1367.825043][ T6734] loop0: rw=1, want=145, limit=128 [ 1367.836697][ T6734] attempt to access beyond end of device [ 1367.845782][ T6734] loop0: rw=1, want=3457, limit=128 [ 1367.919006][ T6734] attempt to access beyond end of device [ 1367.924686][ T6734] loop0: rw=1, want=3857, limit=128 [ 1367.956002][ T6725] attempt to access beyond end of device [ 1367.962359][ T6766] attempt to access beyond end of device [ 1367.968026][ T6766] loop5: rw=1, want=130, limit=128 [ 1367.984475][ T6725] loop0: rw=2049, want=4201, limit=128 [ 1368.113422][ T6766] attempt to access beyond end of device [ 1368.129120][ T6766] loop5: rw=1, want=131, limit=128 [ 1368.140167][ T6766] attempt to access beyond end of device [ 1368.148152][ T6766] loop5: rw=1, want=132, limit=128 [ 1368.153315][ T6766] attempt to access beyond end of device [ 1368.177710][ T6766] loop5: rw=1, want=133, limit=128 [ 1368.188957][ T6766] attempt to access beyond end of device [ 1368.194666][ T6766] loop5: rw=1, want=142, limit=128 [ 1368.200771][ T6766] attempt to access beyond end of device [ 1368.206413][ T6766] loop5: rw=1, want=143, limit=128 [ 1368.211683][ T6766] attempt to access beyond end of device [ 1368.217330][ T6766] loop5: rw=1, want=144, limit=128 [ 1368.222999][ T6766] attempt to access beyond end of device [ 1368.228855][ T6766] loop5: rw=1, want=145, limit=128 [ 1368.234449][ T6766] attempt to access beyond end of device [ 1368.240240][ T6766] loop5: rw=1, want=233, limit=128 [ 1368.728579][ T6772] attempt to access beyond end of device [ 1368.734777][ T6772] loop5: rw=1, want=130, limit=128 [ 1368.741200][ T6758] attempt to access beyond end of device [ 1368.746856][ T6758] loop5: rw=2049, want=3297, limit=128 [ 1368.753607][ T6772] attempt to access beyond end of device [ 1368.763711][ T6772] loop5: rw=1, want=131, limit=128 [ 1368.772257][ T6758] attempt to access beyond end of device [ 1368.777901][ T6758] loop5: rw=2049, want=5345, limit=128 [ 1368.783873][ T6772] attempt to access beyond end of device [ 1368.789614][ T6772] loop5: rw=1, want=132, limit=128 [ 1368.794740][ T6772] attempt to access beyond end of device [ 1368.801602][ T6766] attempt to access beyond end of device [ 1368.801621][ T6772] loop5: rw=1, want=133, limit=128 [ 1368.807315][ T6766] loop5: rw=2049, want=2753, limit=128 [ 1368.812553][ T6772] attempt to access beyond end of device [ 1368.829571][ T6766] attempt to access beyond end of device [ 1368.829635][ T6772] loop5: rw=1, want=142, limit=128 [ 1368.835280][ T6766] loop5: rw=2049, want=7441, limit=128 [ 1368.840413][ T6772] attempt to access beyond end of device [ 1368.840428][ T6772] loop5: rw=1, want=143, limit=128 [ 1368.856766][ T6772] attempt to access beyond end of device [ 1368.857308][ T6766] attempt to access beyond end of device [ 1368.862517][ T6772] loop5: rw=1, want=144, limit=128 [ 1368.862553][ T6772] attempt to access beyond end of device [ 1368.862563][ T6772] loop5: rw=1, want=145, limit=128 [ 1368.884663][ T6766] loop5: rw=2049, want=9497, limit=128 [ 1368.891703][ T6758] attempt to access beyond end of device [ 1368.897382][ T6758] loop5: rw=2049, want=5393, limit=128 [ 1368.906786][ T6766] attempt to access beyond end of device [ 1368.912528][ T6766] loop5: rw=2049, want=9593, limit=128 [ 1368.923009][ T6758] attempt to access beyond end of device [ 1368.928944][ T6758] loop5: rw=2049, want=10817, limit=128 [ 1368.935173][ T6766] attempt to access beyond end of device [ 1368.940928][ T6766] loop5: rw=2049, want=13713, limit=128 [ 1368.948557][ T6758] attempt to access beyond end of device [ 1368.954231][ T6758] loop5: rw=2049, want=13729, limit=128 [ 1368.964254][ T6766] attempt to access beyond end of device [ 1368.966515][ T6758] attempt to access beyond end of device [ 1368.971046][ T6766] loop5: rw=2049, want=14073, limit=128 [ 1368.976221][ T6758] loop5: rw=2049, want=18161, limit=128 [ 1368.996855][ T6758] attempt to access beyond end of device [ 1369.002557][ T6758] loop5: rw=2049, want=26065, limit=128 [ 1369.021375][ T6758] attempt to access beyond end of device 01:28:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x880000, 0x4) 01:28:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:37 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:37 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:37 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:37 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x1, 0x0, 0x0, 0x7f, 0x10002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1369.027019][ T6758] loop5: rw=2049, want=32881, limit=128 01:28:38 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:28:38 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:38 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:28:38 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 01:28:38 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:28:38 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) [ 1370.438587][ T6821] attempt to access beyond end of device [ 1370.445804][ T6821] loop5: rw=1, want=130, limit=128 [ 1370.451241][ T6821] buffer_io_error: 43 callbacks suppressed [ 1370.451258][ T6821] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1370.466023][ T6821] attempt to access beyond end of device [ 1370.471955][ T6821] loop5: rw=1, want=131, limit=128 [ 1370.477165][ T6821] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1370.485839][ T6821] attempt to access beyond end of device [ 1370.491607][ T6821] loop5: rw=1, want=132, limit=128 [ 1370.496814][ T6821] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1370.505502][ T6821] attempt to access beyond end of device [ 1370.511299][ T6821] loop5: rw=1, want=133, limit=128 [ 1370.516493][ T6821] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1370.525169][ T6821] attempt to access beyond end of device [ 1370.530937][ T6821] loop5: rw=1, want=142, limit=128 [ 1370.536129][ T6821] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1370.545619][ T6821] attempt to access beyond end of device [ 1370.552112][ T6821] loop5: rw=1, want=143, limit=128 [ 1370.557308][ T6821] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1370.566022][ T6821] attempt to access beyond end of device [ 1370.571873][ T6821] loop5: rw=1, want=144, limit=128 [ 1370.577061][ T6821] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1370.585711][ T6821] attempt to access beyond end of device [ 1370.591529][ T6821] loop5: rw=1, want=145, limit=128 [ 1370.596748][ T6821] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1370.611930][ T6821] attempt to access beyond end of device [ 1370.617667][ T6821] loop5: rw=1, want=3977, limit=128 [ 1370.629236][ T6821] attempt to access beyond end of device [ 1370.634971][ T6821] loop5: rw=1, want=6033, limit=128 [ 1370.644410][ T6821] attempt to access beyond end of device [ 1370.651042][ T6821] loop5: rw=1, want=7657, limit=128 [ 1371.106658][ T6823] attempt to access beyond end of device [ 1371.118205][ T6823] loop5: rw=1, want=130, limit=128 [ 1371.120956][ T6814] attempt to access beyond end of device [ 1371.124240][ T6823] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1371.138144][ T6814] loop5: rw=2049, want=1065, limit=128 [ 1371.145263][ T6823] attempt to access beyond end of device [ 1371.147482][ T6814] attempt to access beyond end of device [ 1371.152758][ T6823] loop5: rw=1, want=131, limit=128 [ 1371.157757][ T6821] attempt to access beyond end of device [ 1371.167557][ T6823] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1371.168237][ T6821] loop5: rw=2049, want=1689, limit=128 [ 1371.176219][ T6823] attempt to access beyond end of device [ 1371.181959][ T6814] loop5: rw=2049, want=9705, limit=128 [ 1371.192942][ T6823] loop5: rw=1, want=132, limit=128 [ 1371.199906][ T6814] attempt to access beyond end of device [ 1371.204046][ T6823] attempt to access beyond end of device [ 1371.205550][ T6814] loop5: rw=2049, want=11761, limit=128 [ 1371.210489][ T6814] attempt to access beyond end of device [ 1371.212299][ T6823] loop5: rw=1, want=133, limit=128 [ 1371.217146][ T6814] loop5: rw=2049, want=13809, limit=128 [ 1371.227251][ T6823] attempt to access beyond end of device [ 1371.232923][ T6814] attempt to access beyond end of device [ 1371.234190][ T6823] loop5: rw=1, want=142, limit=128 [ 1371.239230][ T6814] loop5: rw=2049, want=16193, limit=128 [ 1371.248172][ T6823] attempt to access beyond end of device [ 1371.257699][ T6814] attempt to access beyond end of device [ 1371.266162][ T6823] loop5: rw=1, want=143, limit=128 [ 1371.266904][ T6814] loop5: rw=2049, want=20289, limit=128 [ 1371.272461][ T6823] attempt to access beyond end of device [ 1371.282983][ T6823] loop5: rw=1, want=144, limit=128 [ 1371.288222][ T6823] attempt to access beyond end of device [ 1371.293938][ T6823] loop5: rw=1, want=145, limit=128 [ 1371.294140][ T6814] attempt to access beyond end of device [ 1371.314043][ T6814] loop5: rw=2049, want=24385, limit=128 [ 1371.343866][ T6814] attempt to access beyond end of device [ 1371.355915][ T6814] loop5: rw=2049, want=32281, limit=128 01:28:40 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:40 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000ff00"}) 01:28:40 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:40 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x1000000, 0x4) 01:28:40 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 01:28:40 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x2ac, &(0x7f0000000580), 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) ioctl$KDMKTONE(r2, 0x4b30, 0x3) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1371.371496][ T6814] attempt to access beyond end of device [ 1371.377153][ T6814] loop5: rw=2049, want=32881, limit=128 01:28:40 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000100"}) [ 1371.521185][ T6832] FAT-fs (loop0): bogus number of reserved sectors 01:28:40 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x0, 0x4, 0x8, 0xf1a}, 0x2c) [ 1371.580877][ T6832] FAT-fs (loop0): Can't find a valid FAT filesystem [ 1371.588275][ C0] net_ratelimit: 20 callbacks suppressed [ 1371.588284][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1371.599761][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1371.668878][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1371.675101][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1371.682122][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1371.688213][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:28:40 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000800100"}) 01:28:40 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x0, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:40 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000200"}) 01:28:40 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x0, 0x4, 0x8, 0xf1a}, 0x2c) 01:28:41 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:41 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:41 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000300"}) [ 1372.510687][ T6832] FAT-fs (loop0): bogus number of reserved sectors [ 1372.596716][ T6832] FAT-fs (loop0): Can't find a valid FAT filesystem [ 1372.738673][ T6885] attempt to access beyond end of device [ 1372.747809][ T6885] loop5: rw=1, want=130, limit=128 [ 1372.753987][ T6885] attempt to access beyond end of device [ 1372.760191][ T6885] loop5: rw=1, want=131, limit=128 [ 1372.765535][ T6885] attempt to access beyond end of device [ 1372.778585][ T6885] loop5: rw=1, want=132, limit=128 [ 1372.788163][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1372.788168][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1372.788211][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1372.793998][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1372.800207][ T6885] attempt to access beyond end of device [ 1372.821449][ T6885] loop5: rw=1, want=133, limit=128 [ 1372.826992][ T6885] attempt to access beyond end of device [ 1372.842056][ T6885] loop5: rw=1, want=142, limit=128 [ 1372.847393][ T6885] attempt to access beyond end of device [ 1372.853468][ T6885] loop5: rw=1, want=143, limit=128 [ 1372.860494][ T6885] attempt to access beyond end of device [ 1372.866335][ T6885] loop5: rw=1, want=144, limit=128 [ 1372.871851][ T6885] attempt to access beyond end of device [ 1372.877720][ T6885] loop5: rw=1, want=145, limit=128 [ 1372.886245][ T6885] attempt to access beyond end of device [ 1372.892272][ T6885] loop5: rw=1, want=1657, limit=128 [ 1373.397709][ T6881] attempt to access beyond end of device [ 1373.403517][ T6881] loop5: rw=2049, want=4001, limit=128 [ 1373.412542][ T6881] attempt to access beyond end of device [ 1373.418398][ T6881] loop5: rw=2049, want=6209, limit=128 [ 1373.427955][ T6881] attempt to access beyond end of device [ 1373.433902][ T6881] loop5: rw=2049, want=8257, limit=128 [ 1373.444392][ T6881] attempt to access beyond end of device [ 1373.450132][ T6881] loop5: rw=2049, want=10305, limit=128 [ 1373.461288][ T6881] attempt to access beyond end of device [ 1373.466931][ T6881] loop5: rw=2049, want=14001, limit=128 [ 1373.477686][ T6881] attempt to access beyond end of device [ 1373.483495][ T6881] loop5: rw=2049, want=17993, limit=128 [ 1373.491387][ T6881] attempt to access beyond end of device 01:28:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x2000000, 0x4) 01:28:42 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x0, 0x8, 0xf1a}, 0x2c) 01:28:42 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000400"}) 01:28:42 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='\x04\x00\x00\x00\xa6', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x1000000, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:28:42 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:42 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1373.497027][ T6881] loop5: rw=2049, want=18585, limit=128 01:28:42 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000500"}) 01:28:42 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x0, 0x8, 0xf1a}, 0x2c) 01:28:42 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:42 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000600"}) 01:28:42 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x0, 0x8, 0xf1a}, 0x2c) 01:28:42 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) [ 1374.459523][ T6941] attempt to access beyond end of device [ 1374.486175][ T6941] loop5: rw=1, want=130, limit=128 [ 1374.534433][ T6941] attempt to access beyond end of device [ 1374.578354][ T6941] loop5: rw=1, want=131, limit=128 [ 1374.590624][ T6941] attempt to access beyond end of device [ 1374.625224][ T6941] loop5: rw=1, want=132, limit=128 [ 1374.657723][ T6941] attempt to access beyond end of device [ 1374.693668][ T6941] loop5: rw=1, want=133, limit=128 [ 1374.728612][ T6941] attempt to access beyond end of device [ 1374.741287][ T6941] loop5: rw=1, want=142, limit=128 [ 1374.752289][ T6941] attempt to access beyond end of device [ 1374.764855][ T6941] loop5: rw=1, want=143, limit=128 [ 1374.775903][ T6941] attempt to access beyond end of device [ 1374.788254][ T6941] loop5: rw=1, want=144, limit=128 [ 1374.838154][ T6941] attempt to access beyond end of device [ 1374.843840][ T6941] loop5: rw=1, want=145, limit=128 [ 1374.856224][ T6941] attempt to access beyond end of device [ 1374.878146][ T6941] loop5: rw=1, want=4761, limit=128 [ 1374.902332][ T6941] attempt to access beyond end of device [ 1374.908005][ T6941] loop5: rw=1, want=8809, limit=128 [ 1374.931845][ T6941] attempt to access beyond end of device [ 1374.937491][ T6941] loop5: rw=1, want=11305, limit=128 [ 1374.964766][ T6941] attempt to access beyond end of device [ 1374.977337][ T6941] loop5: rw=1, want=13505, limit=128 [ 1374.988258][ T6941] attempt to access beyond end of device [ 1374.994032][ T6941] loop5: rw=1, want=15529, limit=128 [ 1375.196685][ T6934] attempt to access beyond end of device [ 1375.208763][ T6934] loop5: rw=2049, want=18193, limit=128 [ 1375.227329][ T6934] attempt to access beyond end of device [ 1375.234135][ T6934] loop5: rw=2049, want=21633, limit=128 01:28:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3000000, 0x4) 01:28:44 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:44 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:44 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x0, 0xf1a}, 0x2c) 01:28:44 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:44 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0x1) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = getpgrp(0x0) r5 = syz_open_procfs(r4, &(0x7f0000000100)='attr/keycreate\x00') sendfile(r3, r5, 0x0, 0xffffffff) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2) ioctl$TUNSETFILTEREBPF(r5, 0x800454e1, &(0x7f0000000080)=r0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0x6) fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, r6, 0x100) r7 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r7, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r7, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r8 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r7, r8, 0x0, 0xffffffff) ioctl$VIDIOC_DQEVENT(r8, 0x80885659, &(0x7f00000001c0)) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f00000000c0)=0x7) setfsgid(r6) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r9, 0x0, 0xffffffff) r10 = socket$bt_bnep(0x1f, 0x3, 0x4) fadvise64(r10, 0x0, 0x6, 0x2) [ 1375.248688][ T6934] attempt to access beyond end of device [ 1375.254348][ T6934] loop5: rw=2049, want=22985, limit=128 01:28:44 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:28:44 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:44 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x0, 0xf1a}, 0x2c) 01:28:44 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:28:44 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:44 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1375.935144][ T6994] attempt to access beyond end of device [ 1375.953672][ T6994] loop5: rw=1, want=130, limit=128 [ 1376.028242][ T6994] buffer_io_error: 22 callbacks suppressed [ 1376.028277][ T6994] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1376.078192][ T6994] attempt to access beyond end of device [ 1376.094117][ T6994] loop5: rw=1, want=131, limit=128 [ 1376.100879][ T6994] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1376.147737][ T6994] attempt to access beyond end of device [ 1376.180022][ T6994] loop5: rw=1, want=132, limit=128 [ 1376.196527][ T6994] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1376.231551][ T6994] attempt to access beyond end of device [ 1376.255712][ T6994] loop5: rw=1, want=133, limit=128 [ 1376.261020][ T6994] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1376.270263][ T6994] attempt to access beyond end of device [ 1376.277784][ T6994] loop5: rw=1, want=142, limit=128 [ 1376.284725][ T6994] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1376.295821][ T6994] attempt to access beyond end of device [ 1376.304298][ T6994] loop5: rw=1, want=143, limit=128 [ 1376.312239][ T6994] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1376.321262][ T6994] attempt to access beyond end of device [ 1376.326971][ T6994] loop5: rw=1, want=144, limit=128 [ 1376.332608][ T6994] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1376.341521][ T6994] attempt to access beyond end of device [ 1376.347246][ T6994] loop5: rw=1, want=145, limit=128 [ 1376.356162][ T6994] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1376.373668][ T6994] attempt to access beyond end of device [ 1376.396906][ T6994] loop5: rw=1, want=5401, limit=128 [ 1376.687157][ T6990] attempt to access beyond end of device [ 1376.693386][ T6990] loop5: rw=2049, want=10041, limit=128 [ 1376.706873][ T6990] attempt to access beyond end of device [ 1376.722068][ T6990] loop5: rw=2049, want=12089, limit=128 01:28:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x0, 0xf1a}, 0x2c) 01:28:45 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:45 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:28:45 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:45 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x4000000, 0x4) 01:28:45 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/adsp1\x00', 0xc080, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x100, 0x9, 0x5, 0x937b}]}) [ 1376.732202][ T6990] attempt to access beyond end of device [ 1376.737857][ T6990] loop5: rw=2049, want=13753, limit=128 01:28:45 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:45 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000fffffdfd00"}) [ 1376.920132][ T7016] attempt to access beyond end of device [ 1376.948250][ C0] net_ratelimit: 20 callbacks suppressed [ 1376.948258][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1376.958164][ C1] protocol 88fb is buggy, dev hsr_slave_0 01:28:45 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8}, 0x2c) [ 1376.959811][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1376.965458][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:28:45 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) [ 1377.055620][ T7016] loop0: rw=1, want=130, limit=128 [ 1377.074126][ T7016] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1377.161493][ T7016] attempt to access beyond end of device 01:28:45 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000ff00"}) [ 1377.206543][ T7016] loop0: rw=1, want=131, limit=128 01:28:46 executing program 2: r0 = syz_open_dev$video(0x0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:46 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8}, 0x2c) [ 1377.234302][ T27] audit: type=1326 audit(1577150925.973:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=7006 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=228 compat=0 ip=0x45d75a code=0x0 [ 1377.260854][ T7016] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1377.309403][ T7016] attempt to access beyond end of device [ 1377.405237][ T7016] loop0: rw=1, want=132, limit=128 01:28:46 executing program 2: r0 = syz_open_dev$video(0x0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:46 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000fdfdffff00"}) [ 1377.477822][ T7016] attempt to access beyond end of device [ 1377.495885][ T7044] attempt to access beyond end of device [ 1377.508299][ T7044] loop5: rw=1, want=130, limit=128 [ 1377.589124][ T7044] attempt to access beyond end of device [ 1377.594808][ T7044] loop5: rw=1, want=131, limit=128 [ 1377.627226][ T7016] loop0: rw=1, want=133, limit=128 [ 1377.718888][ T7016] attempt to access beyond end of device [ 1377.748200][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1377.754018][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:28:46 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1377.778289][ T7016] loop0: rw=1, want=142, limit=128 [ 1377.802352][ T7044] attempt to access beyond end of device [ 1377.808028][ T7044] loop5: rw=1, want=132, limit=128 [ 1377.828164][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1377.833959][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1377.850144][ T7016] attempt to access beyond end of device [ 1377.889124][ T7016] loop0: rw=1, want=143, limit=128 [ 1377.898171][ T7016] attempt to access beyond end of device [ 1377.903834][ T7016] loop0: rw=1, want=144, limit=128 [ 1377.908191][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1377.914708][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1377.917575][ T7044] attempt to access beyond end of device [ 1377.926518][ T7044] loop5: rw=1, want=133, limit=128 [ 1377.939535][ T7009] attempt to access beyond end of device [ 1377.948673][ T7009] loop0: rw=2049, want=2721, limit=128 [ 1377.955481][ T7044] attempt to access beyond end of device [ 1377.961506][ T7016] attempt to access beyond end of device [ 1377.967174][ T7016] loop0: rw=1, want=145, limit=128 [ 1377.978210][ T7044] loop5: rw=1, want=142, limit=128 [ 1377.983359][ T7044] attempt to access beyond end of device [ 1377.992922][ T7009] attempt to access beyond end of device [ 1377.999847][ T7009] loop0: rw=2049, want=3617, limit=128 [ 1378.018159][ T7044] loop5: rw=1, want=143, limit=128 [ 1378.023331][ T7044] attempt to access beyond end of device [ 1378.048126][ T7044] loop5: rw=1, want=144, limit=128 [ 1378.053307][ T7044] attempt to access beyond end of device [ 1378.059391][ T7044] loop5: rw=1, want=145, limit=128 [ 1378.068921][ T7044] attempt to access beyond end of device [ 1378.074579][ T7044] loop5: rw=1, want=2769, limit=128 [ 1378.085197][ T7044] attempt to access beyond end of device [ 1378.091266][ T7044] loop5: rw=1, want=4825, limit=128 [ 1378.115328][ T7044] attempt to access beyond end of device [ 1378.121037][ T7044] loop5: rw=1, want=7385, limit=128 [ 1378.132203][ T7044] attempt to access beyond end of device [ 1378.137865][ T7044] loop5: rw=1, want=9897, limit=128 [ 1378.146574][ T7044] attempt to access beyond end of device [ 1378.152644][ T7044] loop5: rw=1, want=10793, limit=128 01:28:47 executing program 2: r0 = syz_open_dev$video(0x0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:47 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8}, 0x2c) 01:28:47 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000100"}) 01:28:47 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x5000000, 0x4) 01:28:47 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) setsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, &(0x7f00000001c0)=0x8, 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, 0x0, 0xffffffff) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r5, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r6}) sendmsg$nl_route(r4, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x14300000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000001600000127bd7000fcdbdf2502010490", @ANYRES32=r6, @ANYBLOB="14000345c47269646754000800f80001140003007475ee6c30000000000000ff00000000"], 0x50}, 0x1, 0x0, 0x0, 0x8001}, 0x80) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1378.279112][ T7038] attempt to access beyond end of device [ 1378.285014][ T7038] loop5: rw=2049, want=12849, limit=128 [ 1378.293403][ T7038] attempt to access beyond end of device [ 1378.299299][ T7038] loop5: rw=2049, want=13097, limit=128 01:28:47 executing program 2: syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:47 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000800100"}) 01:28:47 executing program 2: syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:47 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2600000013003ff1eb14c1f8030322ff0c1000e313000000093903680000000006000300124b", 0x26) [ 1378.664363][ T7092] K: renamed from caif0 01:28:47 executing program 2: syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:47 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000200"}) [ 1378.768253][ T7092] device K entered promiscuous mode [ 1378.808134][ T7128] attempt to access beyond end of device [ 1378.819127][ T7128] loop5: rw=1, want=130, limit=128 [ 1378.833360][ T7128] attempt to access beyond end of device [ 1378.850678][ T7128] loop5: rw=1, want=131, limit=128 01:28:47 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:47 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0) [ 1378.856553][ T7128] attempt to access beyond end of device [ 1378.862399][ T7128] loop5: rw=1, want=132, limit=128 [ 1378.867618][ T7128] attempt to access beyond end of device [ 1378.873406][ T7128] loop5: rw=1, want=133, limit=128 [ 1378.879200][ T7128] attempt to access beyond end of device [ 1378.884931][ T7128] loop5: rw=1, want=142, limit=128 [ 1378.890198][ T7128] attempt to access beyond end of device [ 1378.916083][ T7128] loop5: rw=1, want=143, limit=128 01:28:47 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0) [ 1378.979138][ T7128] attempt to access beyond end of device 01:28:47 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2600000013003ff1eb14c1f8030322ff0c1000e313000000093903680000000006000300124b", 0x26) [ 1379.060619][ T7128] loop5: rw=1, want=144, limit=128 [ 1379.138718][ T7128] attempt to access beyond end of device [ 1379.165457][ T7128] loop5: rw=1, want=145, limit=128 [ 1379.228948][ T7128] attempt to access beyond end of device [ 1379.263805][ T7128] loop5: rw=1, want=1841, limit=128 [ 1379.355381][ T7079] attempt to access beyond end of device [ 1379.375545][ T7079] loop0: rw=2049, want=130, limit=128 [ 1379.394217][ T7079] attempt to access beyond end of device [ 1379.402739][ T7079] loop0: rw=2049, want=131, limit=128 [ 1379.412113][ T7079] attempt to access beyond end of device [ 1379.418019][ T7079] loop0: rw=2049, want=132, limit=128 [ 1379.427790][ T7079] attempt to access beyond end of device [ 1379.437332][ T7079] loop0: rw=2049, want=133, limit=128 [ 1379.443574][ T7079] attempt to access beyond end of device [ 1379.450730][ T7079] loop0: rw=2049, want=142, limit=128 [ 1379.456308][ T7079] attempt to access beyond end of device [ 1379.462430][ T7079] loop0: rw=2049, want=143, limit=128 [ 1379.468049][ T7079] attempt to access beyond end of device [ 1379.474189][ T7079] loop0: rw=2049, want=144, limit=128 [ 1379.480142][ T7079] attempt to access beyond end of device [ 1379.485948][ T7079] loop0: rw=2049, want=145, limit=128 [ 1379.496577][ T7079] attempt to access beyond end of device [ 1379.514702][ T7079] loop0: rw=2049, want=353, limit=128 01:28:48 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x6000000, 0x4) 01:28:48 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000300"}) 01:28:48 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0) 01:28:48 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) kexec_load(0x0, 0x10, &(0x7f00000005c0)=[{0x0}], 0x0) 01:28:48 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0xaaaaaaaaaaaad29, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1379.545594][ T7093] attempt to access beyond end of device [ 1379.554488][ T7093] loop5: rw=2049, want=3897, limit=128 [ 1379.566676][ T7093] attempt to access beyond end of device [ 1379.572897][ T7093] loop5: rw=2049, want=5689, limit=128 01:28:48 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x0, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:48 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000400"}) 01:28:48 executing program 4: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) kexec_load(0x0, 0x10, &(0x7f00000005c0)=[{0x0}], 0x0) 01:28:48 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:48 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x0, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:48 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000500"}) 01:28:48 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000600"}) 01:28:49 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x7000000, 0x4) 01:28:49 executing program 4: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:49 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x0, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:49 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:49 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) syz_mount_image$nfs4(&(0x7f0000000000)='nfs4\x00', &(0x7f0000000040)='./bus\x00', 0x7fff, 0x6, &(0x7f0000000480)=[{&(0x7f0000000080)="d238a814ff40a71e24ac9b55da7fbac50621e0d1feca36f435f0ba9a02451c5f55331dca2eddfdf2d5385bc1a6df0a23c9cc114b6620eaa9381125e6412ec1a904447bf887044287a28e72c1c5f1da0568026e6fb56e24f5fbb6a3d61c100abe44b00cce8a91ed741b47f96cead6323e4d7a3506a2", 0x75}, {&(0x7f00000001c0)="ad5c393fd296c39a0c1ae3f7329c8d2fc54510ad90c0195e3eaeb28eb7de9796a2d3cb01675a690ac4c19bbd3be0cd9419e691cc34451b88eaecb260315440885d13d0a68392432defc2f7cdcd1907b07c93fe39e9e82e2fb041d952188985ebe14d4f183ddd9e2fdff6597f420e89facd1ceac86a724afbc278950af3ec71a69dd5ef85aa330aee67e1af80198c22b7002954df431cf3f561dca4f54894e90329f74fbb90e584f3391f4afcca207ca1", 0xb0, 0x4}, {&(0x7f0000000100)="3a1664c4bacd0ce399f15b43ebd94a5ef2", 0x11, 0x5}, {&(0x7f0000000300)="5a76ff666de7e790b6694955aa097b0cdacc2a1fb954f2243b618d03474dc52ff320b52279527241bbb1320a2ae1c2116313c51f934f3a7045a7b8578da2a0c35108f281159b302dce7cbb41fd1275389493d6f9b939f6c85186c0edbeb71e2f9bb9d881d78d48b59a6006abc8d19f6956e7b4f83bff0d3f5b3b12084609b36210a73ef8f339211c21113ea70636848608f575b0ab870594ba17d1687a5cebef346299814376417b0f0f51c6a21b2d46dd81bdf495c2f9a44b39a70797109ee8da51aa4559117cd8400e7eac2821", 0xce, 0x4}, {&(0x7f0000000400)="af6c2c168045b00ce5761dc8339b2abdae54d915ceb0aafd631a67bd926c43242ed4c051faa7633ce2b27d22bff10dc274ad0115af6fb127480125f3d049370e82e72837d48ef6f1ffe4fac6a0d34bff8b53bc5a2f97", 0x56, 0x4}, {&(0x7f00000005c0)="76e9404381503fae866a65ec88a21c86dd9131dfb65a5beee0c97c73e4cf84fb0d37fc0e223570561f4ab4bfd8671299fcd86828ef64ed4782779094d42e3959fe898ea517d9a20f7b4da435bc759b94352f2d42a2e9a93381c918b1f664106de17dca89fcbc283bf535d9a2c3b44c4d0522406ba164d368c95f1f58f38291082e9ae99de04c40d1ab0e0282e8c260c4138a29dbdd828f38eb0839eb502745ee2251c8ec54a9c802064c7a4228199d7a9c6b8b3edd9bdd585a98c8956b61ff1682b3689a4c83b90c2830ed0bed1434da7c34ae9678d082c990b1572954591bf7af77b8f67f9b69f75eefcbb46ab8251c25287a2b75dc891379833e85e8e724beef8edbe50f47f67a7a9348df5ef19fc6fdcd621b55bc66a372413772d0219378cac86b7b3ea823a620f76996423f4583617b1ee49ed89fbaabc9542fccb2333cb8b52d5a4d2ac67a4bc9c456c3c84fef7c77db00e7d38bd419a62f6747208961b4c97f67b3e890618a0e6cb974476d02eff618fbb7cb39e47df2484fdb58472246bf5c3733f2eb935588173d878f3b6a89052832537bac477d73e0a1ec3fa915bd4f8a361b38bda1403211ec4e61ce83e6158ae90876bb07a90d82fec8300f122b47f390d297b3aec0d4f4b4849fc49897c62aa9165c930ad3ca4b1b52cb96f2ce12f6a73bc40a2ad027c1f5112eabc63c098835cfbfaae7a3871134d5515657bf7bd7e7578c5dcfc38569b5a3b11abfe9ac3c2fbe2516a72477f762461c830b0922fc37dca6b60e07af23eaeff3e185858d3d197d54589258473f6abb350f8eba6ffd050cd5ad2db09cc8382a93520687b8418017a85a5df809ac13620f1bc6d8bcbb5d512681113e7e93b80963a766f3e5a935c10ed7712b07825089f8427a3aec043b312721582e31b220b6edf144faafe74b9b203a6d0ae61ceb6cc0e839f317ab3f0cf58a279521a99c1687d3df45ea912c20c46c3f6b59e308505ecfb000b19f87a530b2b03c83b046b2147e14356bb394f4a5007d0ee02de73616a7f23381640af5562d3e19d54d34ddb38faa7cf7edd429cafcf5320913121d561dcd1705f5dddf97c2b1341dc93a4d73ccf3c34abab48234e4b7678c1bd417a3c79d73514689b377313ed81183e4777bf7ff40b8b975085e7047bf5ed877440bea91fc3d84bcb5e64bb68223fba922e15234b6359a73e196e927b1ef22b01f4e524194639d51c80d22d5f140e90a0402d519943bd71019b8c9f35276f064da9ddb712f5e61e7dde5b4f768949dc58fce7ca3f658d0a313d0e1cd2182617ed3e92aaaf927093576629b8537cf3de0b3bcaf65b1ce18921397caa3cec589f0bc9fe988a8c4524415b126f74ed7135750bd60bea619ad5753de152fa385d28b9efa36c5d391a2e687e0395605251eb576728031f85cb3b785a29daab2f977397386c84df9072e090de66c3d2744f66174ecda03e3a2eefd549a9f6cbeb71c916b5c86f73ab6db8c4c35e3a48c5b40a073db3c5f639efb5de546820409242dd6af0e6dc611365ff4391289416e8154e9a6efd1279a8572537b5fceef3d9358d1fb793911b08e1cf1ff3f66adac1aa4c6623a0e3beed1925c77deb5474ce8a33027880edf3b9072b3b6d0c6d1a37661e057bc2261ff6c77df3b35770d3ea7fe59fa9f5d3613f45edd78c1fd9269eaba8c1226f0b2633ba820ddd1c0938fe3e2a0f0cf8288216c2c69b894a80922627d92536306dc6e51f91452ec2251ffd0289c4f92389aaaab54de7e7437446155a68879903e3074bbdd3e07c14d433c22118b755fac7348a49bbfad10ca33cc5b958ec147650d378a334ece7925d7970a4c47bf439cdbb58329942e064adcef6efdcea6e971bb63ee4bd0324cb3f185ba4377b61bce6fe0c8a9f1b312859bda57580a893fb8eabdff0b89bf3608bb4b82937140c3bde82c8f6251eb3d10020c07cea644c86cfd5c6a429f26e4f7cd39c8eebb6929d7828d345a46d4a91d8d59d0cc1aab1e874e97f4057b12261786307beda5ec414d1f9f83282dc587ecfa303a51213b4cd3146bad67407462e8ae818c9adada64688415018d702e00a6b1d478eee7a2c5e816c3f97c45218288fb7f13c658302fd5353acf39d6f907e38ae59d95b76bcb362ff37b4e68ae604258c7c3d47972a33b38577df154a0a24785127a03c54725c45d426137af5677b398f8564c512eaacf0ed18ace4900f47173afaa619c05200242f462da7d734336ed61c1fa9cc9dcae454d06d4d2b06ba2b816a36fbae9374cc6cb947f2f9451bd37955291cc90528cb1f1ec0818702b732f0041e3075e1ac7a08b1b8db6ec8aa9cfb928983903cbc0a7b437f78ed5098983287a686297a5893b2089923f8c57ae26b186a77c2819e59885f7e93f8d9c67850784659495bd69e8a412d7a48d93762a8d890c4c9b745e84a2889f677fda0f95c92652fd14e9a05656a85d044ee347f39a77a8166fb1a524a636ad3315e7542c71e0f31d145291d4a1b2af750c71142231e4f69056c8024a235259c729acf3ab42814fe69f62559e74ff9ece256135d668f51af394c9ade6c96ecaf043ff81d6fb75e99fb534873e5fca9f213522457044d747b12f3dbbacee484159f2aa879743074a732c070d23012a45db94feafdfda282fe51995aa956b67532c3f5e848a922ae05313f65fc43c253bd69295020b3a4c89a34bfaf57d23b5afbbbd3667993db6f73f2274862395ff0829db88fa0e3e6bf11f7d65156903c97b455211f2887e099030bce003a2989080a9759557b2079af6a55752a695770663c3e19e9682315c2f51150771baeee527c54b76a8495db7e2bc26ec6b2d8bb0ee32ad6c70a1c367925435f7ff3d19acb1bf592d6d84a85f86df5e61713058c9e074fcf86b445d820631dd2adc6ef78a92cd29115b7538dd5c2a4a07e76a9f0170cccecb12094f57ddbdb97de071df46b4ec73ccfb00e9c1cd19cf8a69c10e99a1992819ad2b0dda8fb27d666cae283cb0efba34024e5a1781bd16674065a0f27fe67ddb83c259dded760adef2ecf6a216aaa4f3f77ce0de7c0efee304314f0a6e3bca0309b2b59ce98ec34d3deadffe3222fef324c85b3752c01bd1bad42a6ad2b9947d4011b2ad25db56c92ce0fe83f80f97104988da0fd621824992f58fa0a9f0d4e9c557f4eba254c01ff331b005bd504e8b6d4fabca95321cd5af26f2e674fccfd4fad0c4c61a7961b0288cb61df07a895b9221286be3ba6d1a90853403eb3e5bc1b375090df31b9dc8491642306d6d087222f9ce69cfa1a63baf7ff697f212a839a6249b8ada7113ea5e3d12fd06bfaf16beac81f86d4d6e5ea287a78c79cad4c7f96de1dddee26b605f0b74bd0ead0a3c3bde10046be67a80b090008103da9cade045d0aafe211f6c06b4653ec0a447b3b2ecb774d18240b8c4bc5bc1935aaa25c9f2f2c97e3243852164fbee2ba35e10744e89fd4e19cb7efa2b33205724cc868a67d0a5aa7fc829f4bbff6f4566b7445d1b39e1923f70005e984852b0386d1b9adbb3bb63e918e20ece1aca763c86d7f400a47d8eee4fb69c17e660c07a86b525ab06a309b8a7a3f94425fb0f4f84c9e3383cb6e597df761a2c553162428c7ce4112bb89ba09b71bc2815b5ac61d4b374ba10ffb34b6e435dc11da6f44f0b9ff55455fdbae4a918f69e641d5c3e88508304dc7d46015d7f18e9ee012fb32b1fb78213134ca2446e9cbb33584cd3f7424ba1cd68bd3d43dd91b8d554320aa6768198611735481157eea81b934f2debf72218232cd4482807d7a5b6d50a8f6f59bc024395328aff2029a4020fad0627a526b2b3c0e24ebcad472ffd9d8854bd0b3c822918afcb7f382d2367e4101158cfd4e57f5162c1e7088e95ae7e55c3423b06b6f926579d1e62ed553a5ffc552b64987bba2fc961cd1d135dd9890641409089aa9d8e0b523c8ca07c151982bf6dab7e80e259632589627723aff7b4a4cdc4db95e562913b610c5718af4e40fa52d504bf2101da1ee92d664cc8bfa6814b9a0b68a6b254746a62750ec6daf642db78eea01eeb30d7ba593ee884d91a2c12832147caf6f7a8b1860bcf06de7cb80fbe41e0edf7cdbabcd4f3d1bf1f97a894aab755aec1835a058df3d3e843c13b7dc9704f0231b8dc83c0d7e53f0da5f867921bbea3fd9ee8338745eaa2bc94baa62d063efab0e2a0e9a2a7d0307cd981cd2012088f92a24eaf1cb8bbec0c4b9390f8ea4c8694ff2a4b30c92ea46bbeacbf3815a5907d73822eedbdf3d46f229c76f527bd2bcaa99755e31f4916cdb9a67af4578b4439620de6ee810f4c052d6451b4de13a8eba7d7d037b7d49c6d3d4f45f8134e258dd82c4e7e1e7692f45e6ce82ae0147678a2013cc0a4a06a5f87ae15edb1b77a84ebf201f8fc81163ffb2c59409bb0e634a1a32a07795c6f87557df80024f54427a3d87ab39d64e394289ef5f5bb5efdaf8ed61fccb2610069200834f3cf6d988998692b79fc09866b806c5c0865c755620cf29e634f1179dc92cdda721dc64dbd1562f4795e3c039c4b2e49ea96f73ceafffb674c7033ebd26fbfda5db01a514752260e855dda297d4fd1c319c1e0704ccfe62c40d48e101e16f10911914b63bcdc10823ad8e4c2f499a9a3e25038d265c69c8a059273c9dffe91f633f76a535d55a8b77f872258c4d4e14ca1a60a4b27871fba2d1e7fadd559ea708e36082c57b72610fe5a1fb8ad7e951f1ade92a0884fbf35dd14ccf4e7b8a1a7eee1d93bce15c0642a15deff67b4b213ae686ce744e5b80f1555d50b1d803cbde3eb393ef186de30cb838f75f247c3287680074ea74c2d3bf1d64c5b9838f663d18ba1c18febefe276e462af416373de39b2f06f73a8819792c5c5c82cedcb0767710b7aa9d67754137116eb701f6e46c8133bb17e94cfbb3262e2151dc85eb16b3160ee3392b182731b7611678a7f7e1b3e9d121f010ffb02571cf9c025e47c7b6e70a1f4a6d4741f14bdd1d25993bb7a61937c1c9860d0591f17f168ec003cbfa0f336704dfa23cfef35305d99a4bffd71f21b35fe3e4a5f50b89e3246a2025faa359dee75373b72e90b8bf868eae35adabd9c2b820356d92dff8b765a3ece34c06e10130b7dadf2d1e83c17842f96ceac0da4e5666ba484732cacb90d2fa66a39ada64951cba79125a2da3881d2f09cf69324e5c95715e79f20fcb2418dbc3cc5a69427d39bab59686841ba04212043e6021a639127af87174fc236f0796190f02d755a65a97a9314dc04c459460ba21857401b4d017ece6fe19d41ed186f6abd576354570e82599746763ebbbd546dc92f107c0ab17d34d41ce0326fbf734d88d626aa882d89f70bdd887a2d81ede142c3d3ade64538c3308e9a649f3406d840af50927f8dda2e9522b33d9635ead2b7ddde356cb5469302da079f1d73026f17c33a6e5c0dc4a8397935ed040abbc33f1a826cd4a1771001f929a2ea72fb74a63e79793b043e2fbdeff32420fd201e6c92d4d6b0968240669ac73ba87a628e39ff6af98e1eeb2ba6cbf0819a5ad14d7585d52d680bf9c511d2773423f16027a422eadc0cda56700757cd7b4861a79acf662fe4e70978bf265d50fa5bac0f021d22d13024f551c56616b677e90327cafdd7715a1375becf6920f984001629f7dc5749c6f97ecc015de5d3e404168eef710cffb081920059a6f3deaf341f8fdf0f8bbefb6bed286296845e43a54ef8253ef74ace2c1fc04fbcd40a754634e95eedbc6da9253b58a9d91cfeb9d2e5fc1914f12de5623bc03d11ab", 0x1000, 0x1}], 0xdd7fa710e5458ebc, &(0x7f0000000280)='vfat\x00') 01:28:49 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x0, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:49 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:49 executing program 4: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:49 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:28:49 executing program 4: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:49 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x0, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:50 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1381.988207][ C0] net_ratelimit: 20 callbacks suppressed [ 1381.988216][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1381.999885][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1382.068201][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1382.074121][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1382.080009][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1382.085788][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:28:51 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x20000000, 0x4) 01:28:51 executing program 4: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:51 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x0, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:51 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:28:51 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:51 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x5, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={'nr', 0x0}, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast]}) 01:28:51 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:51 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:28:51 executing program 4: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:51 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1382.627676][ T7347] attempt to access beyond end of device [ 1382.658014][ T7347] loop0: rw=1, want=130, limit=128 [ 1382.670778][ T7347] buffer_io_error: 30 callbacks suppressed 01:28:51 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) [ 1382.670827][ T7347] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1382.714309][ T7347] attempt to access beyond end of device [ 1382.734339][ T7347] loop0: rw=1, want=131, limit=128 [ 1382.744054][ T7347] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1382.753692][ T7347] attempt to access beyond end of device [ 1382.760027][ T7347] loop0: rw=1, want=132, limit=128 [ 1382.765694][ T7347] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1382.776156][ T7347] attempt to access beyond end of device [ 1382.783280][ T7347] loop0: rw=1, want=133, limit=128 [ 1382.789203][ T7347] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1382.798855][ T7347] attempt to access beyond end of device [ 1382.805291][ T7347] loop0: rw=1, want=142, limit=128 [ 1382.811119][ T7347] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1382.820817][ T7347] attempt to access beyond end of device [ 1382.826844][ T7347] loop0: rw=1, want=143, limit=128 [ 1382.832858][ T7347] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1382.842648][ T7347] attempt to access beyond end of device [ 1382.849037][ T7347] loop0: rw=1, want=144, limit=128 [ 1382.854746][ T7347] Buffer I/O error on dev loop0, logical block 143, lost async page write 01:28:51 executing program 4: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) [ 1382.855039][ T7347] attempt to access beyond end of device [ 1382.855122][ T7347] loop0: rw=1, want=145, limit=128 [ 1382.855205][ T7347] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1382.881964][ T7347] attempt to access beyond end of device [ 1382.882273][ T7347] loop0: rw=1, want=1729, limit=128 [ 1383.188154][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1383.188185][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1383.194135][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1383.380605][ T7337] attempt to access beyond end of device [ 1383.398568][ T7337] loop0: rw=2049, want=3625, limit=128 01:28:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3a000000, 0x4) 01:28:52 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:52 executing program 4: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:52 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000fffffdfd00"}) 01:28:52 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:52 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f0000000000)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:28:52 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000ff00"}) 01:28:52 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x5, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={'nr', 0x0}, 0x5, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast]}) 01:28:52 executing program 4: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) [ 1383.988207][ C1] protocol 88fb is buggy, dev hsr_slave_0 01:28:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000ffffffff00"}) 01:28:53 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:53 executing program 4: r0 = syz_open_dev$video(0x0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:53 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3d000000, 0x4) 01:28:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000200"}) 01:28:53 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:53 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:53 executing program 4: r0 = syz_open_dev$video(0x0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:53 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) memfd_create(&(0x7f0000000000)='wlan0proc\\-mime_type\x00', 0x4) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) prctl$PR_SET_PDEATHSIG(0x1, 0x1b) 01:28:53 executing program 4: r0 = syz_open_dev$video(0x0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000300"}) 01:28:54 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000400"}) 01:28:54 executing program 4: syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:54 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000500"}) 01:28:54 executing program 4: syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:55 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3f000000, 0x4) 01:28:55 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:55 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000600"}) 01:28:55 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:55 executing program 4: syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:55 executing program 0: r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x400040, 0xc3) readahead(r0, 0x94, 0x100000000) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r1, 0x0, 0x0, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) execveat(r3, &(0x7f0000000040)='./bus\x00', &(0x7f00000001c0)=[&(0x7f0000000080)='vfat\x00', &(0x7f00000000c0)='\x00', &(0x7f0000000100)='vfat\x00'], &(0x7f00000003c0)=[&(0x7f0000000200)='vfat\x00', &(0x7f0000000240)='vfat\x00', &(0x7f0000000280)='vfat\x00', &(0x7f0000000300)='trustednodev!/#wlan1\x00', &(0x7f0000000340)='vfat\x00', &(0x7f0000000380)='vfat\x00'], 0x1000) 01:28:55 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:28:55 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0) 01:28:55 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0) [ 1386.549022][ T7506] attempt to access beyond end of device [ 1386.569592][ T7506] loop0: rw=1, want=130, limit=128 [ 1386.578838][ T7506] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1386.590961][ T7506] attempt to access beyond end of device [ 1386.618410][ T7506] loop0: rw=1, want=131, limit=128 01:28:55 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0) 01:28:55 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1386.660206][ T7506] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1386.789561][ T7506] attempt to access beyond end of device [ 1386.814456][ T7506] loop0: rw=1, want=132, limit=128 [ 1386.840894][ T7506] attempt to access beyond end of device [ 1386.886829][ T7523] attempt to access beyond end of device [ 1386.902281][ T7523] loop5: rw=1, want=130, limit=128 [ 1386.915746][ T7523] attempt to access beyond end of device [ 1386.928576][ T7506] loop0: rw=1, want=133, limit=128 01:28:55 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x0, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) [ 1386.936650][ T7523] loop5: rw=1, want=131, limit=128 [ 1386.943139][ T7506] attempt to access beyond end of device [ 1386.955810][ T7506] loop0: rw=1, want=142, limit=128 [ 1386.970546][ T7523] attempt to access beyond end of device [ 1386.992228][ T7506] attempt to access beyond end of device [ 1387.020286][ T7523] loop5: rw=1, want=132, limit=128 [ 1387.036902][ T7506] loop0: rw=1, want=143, limit=128 [ 1387.067618][ T7506] attempt to access beyond end of device [ 1387.097398][ T7523] attempt to access beyond end of device [ 1387.115987][ T7506] loop0: rw=1, want=144, limit=128 [ 1387.135126][ T7523] loop5: rw=1, want=133, limit=128 [ 1387.166890][ T7506] attempt to access beyond end of device [ 1387.184756][ T7523] attempt to access beyond end of device [ 1387.209359][ T7506] loop0: rw=1, want=145, limit=128 [ 1387.219623][ T7523] loop5: rw=1, want=142, limit=128 [ 1387.270338][ T7523] attempt to access beyond end of device [ 1387.285928][ T7506] attempt to access beyond end of device [ 1387.319643][ T7523] loop5: rw=1, want=143, limit=128 [ 1387.348168][ C1] net_ratelimit: 19 callbacks suppressed [ 1387.348177][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1387.348507][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1387.354158][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1387.360088][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1387.385126][ T7523] attempt to access beyond end of device [ 1387.392033][ T7506] loop0: rw=1, want=2329, limit=128 [ 1387.412051][ T7523] loop5: rw=1, want=144, limit=128 [ 1387.422922][ T7523] attempt to access beyond end of device [ 1387.426896][ T7494] attempt to access beyond end of device [ 1387.435377][ T7494] loop0: rw=2049, want=4385, limit=128 [ 1387.435942][ T7523] loop5: rw=1, want=145, limit=128 [ 1387.449826][ T7506] attempt to access beyond end of device [ 1387.455663][ T7506] loop0: rw=1, want=2337, limit=128 [ 1387.457572][ T7523] attempt to access beyond end of device [ 1387.461420][ T7494] attempt to access beyond end of device [ 1387.471240][ T7523] loop5: rw=1, want=2193, limit=128 [ 1387.482957][ T7523] attempt to access beyond end of device [ 1387.494489][ T7494] loop0: rw=2049, want=4393, limit=128 [ 1387.500195][ T7506] attempt to access beyond end of device [ 1387.505921][ T7506] loop0: rw=1, want=4401, limit=128 [ 1387.518209][ T7494] attempt to access beyond end of device [ 1387.523973][ T7494] loop0: rw=2049, want=4409, limit=128 [ 1387.548250][ T7523] loop5: rw=1, want=4417, limit=128 [ 1387.564530][ T7506] attempt to access beyond end of device [ 1387.570275][ T7506] loop0: rw=1, want=4417, limit=128 [ 1387.577136][ T7506] attempt to access beyond end of device [ 1387.584879][ T7523] attempt to access beyond end of device [ 1387.590771][ T7494] attempt to access beyond end of device [ 1387.594073][ T7514] attempt to access beyond end of device [ 1387.596419][ T7494] loop0: rw=2049, want=4425, limit=128 [ 1387.596512][ T7506] loop0: rw=1, want=5497, limit=128 [ 1387.607880][ T7514] loop5: rw=2049, want=7721, limit=128 [ 1387.613078][ T7523] loop5: rw=1, want=7657, limit=128 01:28:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x40000000, 0x4) 01:28:56 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:28:56 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x0, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:56 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:56 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:56 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x8800, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) ioctl$SIOCAX25GETUID(r0, 0x89e0, &(0x7f00000000c0)={0x3, @null, r1}) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x80000000000, 0x0, 0x0) 01:28:56 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000800100"}) 01:28:56 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x0, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:56 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000300"}) 01:28:56 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000500"}) [ 1388.020410][ T7566] attempt to access beyond end of device [ 1388.028261][ T7566] loop5: rw=1, want=130, limit=128 01:28:56 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000600"}) [ 1388.097343][ T7566] buffer_io_error: 14 callbacks suppressed [ 1388.097356][ T7566] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1388.148145][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1388.154131][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:28:56 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) [ 1388.228171][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1388.234078][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1388.244306][ T7566] attempt to access beyond end of device [ 1388.259437][ T7566] loop5: rw=1, want=131, limit=128 [ 1388.270018][ T7566] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1388.308212][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1388.314236][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1388.328891][ T7566] attempt to access beyond end of device [ 1388.349562][ T7566] loop5: rw=1, want=132, limit=128 [ 1388.374492][ T7566] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1388.407357][ T7566] attempt to access beyond end of device [ 1388.423146][ T7566] loop5: rw=1, want=133, limit=128 [ 1388.435644][ T7566] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1388.457032][ T7566] attempt to access beyond end of device [ 1388.470927][ T7566] loop5: rw=1, want=142, limit=128 [ 1388.483101][ T7566] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1388.503768][ T7566] attempt to access beyond end of device [ 1388.517522][ T7566] loop5: rw=1, want=143, limit=128 [ 1388.530135][ T7566] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1388.582782][ T7566] attempt to access beyond end of device [ 1388.616359][ T7566] loop5: rw=1, want=144, limit=128 [ 1388.641473][ T7566] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1388.700623][ T7566] attempt to access beyond end of device [ 1388.728964][ T7554] attempt to access beyond end of device [ 1388.734658][ T7554] loop0: rw=2049, want=130, limit=128 [ 1388.752428][ T7566] loop5: rw=1, want=145, limit=128 [ 1388.763949][ T7554] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1388.772780][ T7566] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1388.783641][ T7554] attempt to access beyond end of device [ 1388.789438][ T7554] loop0: rw=2049, want=131, limit=128 [ 1388.794832][ T7554] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1388.804686][ T7554] attempt to access beyond end of device [ 1388.810763][ T7554] loop0: rw=2049, want=132, limit=128 [ 1388.814019][ T7559] attempt to access beyond end of device [ 1388.816375][ T7554] attempt to access beyond end of device [ 1388.822497][ T7559] loop5: rw=2049, want=1585, limit=128 [ 1388.829261][ T7554] loop0: rw=2049, want=133, limit=128 [ 1388.839129][ T7554] attempt to access beyond end of device [ 1388.840417][ T7566] attempt to access beyond end of device [ 1388.844852][ T7554] loop0: rw=2049, want=142, limit=128 [ 1388.855942][ T7566] loop5: rw=1, want=2137, limit=128 [ 1388.856351][ T7554] attempt to access beyond end of device [ 1388.862427][ T7559] attempt to access beyond end of device [ 1388.867518][ T7554] loop0: rw=2049, want=143, limit=128 [ 1388.879244][ T7554] attempt to access beyond end of device [ 1388.879928][ T7559] loop5: rw=2049, want=2145, limit=128 [ 1388.885004][ T7554] loop0: rw=2049, want=144, limit=128 [ 1388.895734][ T7566] attempt to access beyond end of device [ 1388.895929][ T7554] attempt to access beyond end of device [ 1388.903197][ T7566] loop5: rw=1, want=2153, limit=128 [ 1388.907426][ T7554] loop0: rw=2049, want=145, limit=128 [ 1388.911884][ T7554] attempt to access beyond end of device [ 1388.917787][ T7559] attempt to access beyond end of device [ 1388.918227][ T7554] loop0: rw=2049, want=2473, limit=128 [ 1388.925321][ T7559] loop5: rw=2049, want=2161, limit=128 [ 1388.934278][ T7554] attempt to access beyond end of device [ 1388.940431][ T7566] attempt to access beyond end of device [ 1388.940826][ T7554] loop0: rw=2049, want=4521, limit=128 [ 1388.946719][ T7566] loop5: rw=1, want=2169, limit=128 [ 1388.953979][ T7554] attempt to access beyond end of device [ 1388.963684][ T7559] attempt to access beyond end of device [ 1388.968651][ T7554] loop0: rw=2049, want=4881, limit=128 [ 1388.986555][ T7559] loop5: rw=2049, want=2177, limit=128 [ 1388.993395][ T7566] attempt to access beyond end of device [ 1389.000550][ T7566] loop5: rw=1, want=2185, limit=128 [ 1389.009508][ T7566] attempt to access beyond end of device [ 1389.015240][ T7566] loop5: rw=1, want=4361, limit=128 [ 1389.023334][ T7559] attempt to access beyond end of device [ 1389.035847][ T7559] loop5: rw=2049, want=2273, limit=128 [ 1389.042918][ T7566] attempt to access beyond end of device 01:28:57 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x48000000, 0x4) 01:28:57 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x0, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:28:57 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:28:57 executing program 2: r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x400040, 0xc3) readahead(r0, 0x94, 0x100000000) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r1, 0x0, 0x0, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) execveat(r3, &(0x7f0000000040)='./bus\x00', &(0x7f00000001c0)=[&(0x7f0000000080)='vfat\x00', &(0x7f00000000c0)='\x00', &(0x7f0000000100)='vfat\x00'], &(0x7f00000003c0)=[&(0x7f0000000200)='vfat\x00', &(0x7f0000000240)='vfat\x00', &(0x7f0000000280)='vfat\x00', &(0x7f0000000300)='trustednodev!/#wlan1\x00', &(0x7f0000000340)='vfat\x00', &(0x7f0000000380)='vfat\x00'], 0x1000) 01:28:57 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) mkdir(&(0x7f0000000000)='./bus\x00', 0x48) [ 1389.052493][ T7566] loop5: rw=1, want=4465, limit=128 [ 1389.063971][ T7566] attempt to access beyond end of device [ 1389.064385][ T7559] attempt to access beyond end of device [ 1389.069732][ T7566] loop5: rw=1, want=6009, limit=128 [ 1389.077964][ T7559] loop5: rw=2049, want=4481, limit=128 01:28:57 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x0, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:28:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:28:58 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:28:58 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000ff00"}) [ 1389.492991][ T7620] attempt to access beyond end of device [ 1389.500025][ T7620] loop5: rw=1, want=130, limit=128 [ 1389.505465][ T7620] attempt to access beyond end of device [ 1389.511660][ T7620] loop5: rw=1, want=131, limit=128 [ 1389.516977][ T7620] attempt to access beyond end of device [ 1389.522852][ T7620] loop5: rw=1, want=132, limit=128 [ 1389.528471][ T7620] attempt to access beyond end of device [ 1389.534393][ T7620] loop5: rw=1, want=133, limit=128 01:28:58 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) accept$ax25(r1, &(0x7f0000000000)={{0x3, @netrom}, [@netrom, @null, @remote, @remote, @netrom, @remote, @null]}, &(0x7f0000000080)=0x48) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RSTAT(r1, &(0x7f00000000c0)={0x53, 0x7d, 0x2, {0x0, 0x4c, 0x7fff, 0x200, {0x10, 0x2, 0x8}, 0x40000000, 0x0, 0x7, 0xfff, 0x8, 'pagemap\x00', 0x4, 'self', 0x8, 'pagemap\x00', 0x5, 'vfat\x00'}}, 0x53) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x4000, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r5) sendfile(r3, r4, 0x0, 0xffffffff) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r4, 0x111, 0x4, 0x1, 0x4) fadvise64(r2, 0x0, 0x0, 0x4) 01:28:58 executing program 4: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000000)={0x169, 0x0, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) [ 1389.541248][ T7620] attempt to access beyond end of device [ 1389.547074][ T7620] loop5: rw=1, want=142, limit=128 [ 1389.552682][ T7620] attempt to access beyond end of device [ 1389.552699][ T7620] loop5: rw=1, want=143, limit=128 [ 1389.575214][ T7620] attempt to access beyond end of device [ 1389.613425][ T7615] attempt to access beyond end of device [ 1389.637215][ T7615] loop2: rw=1, want=130, limit=128 [ 1389.645997][ T7620] loop5: rw=1, want=144, limit=128 [ 1389.672420][ T7615] attempt to access beyond end of device [ 1389.709762][ T7620] attempt to access beyond end of device [ 1389.777498][ T7620] loop5: rw=1, want=145, limit=128 [ 1389.798550][ T7615] loop2: rw=1, want=131, limit=128 [ 1389.838630][ T7615] attempt to access beyond end of device [ 1389.845085][ T7620] attempt to access beyond end of device [ 1389.895149][ T7620] loop5: rw=1, want=1689, limit=128 [ 1389.922308][ T7615] loop2: rw=1, want=132, limit=128 [ 1389.959527][ T7615] attempt to access beyond end of device [ 1389.998060][ T7615] loop2: rw=1, want=133, limit=128 [ 1390.069395][ T7615] attempt to access beyond end of device [ 1390.079611][ T7600] attempt to access beyond end of device [ 1390.085329][ T7600] loop2: rw=2049, want=2209, limit=128 [ 1390.096224][ T7639] attempt to access beyond end of device [ 1390.107012][ T7600] attempt to access beyond end of device [ 1390.112789][ T7600] loop2: rw=2049, want=4177, limit=128 [ 1390.118353][ T7639] loop0: rw=1, want=130, limit=128 [ 1390.123724][ T7639] attempt to access beyond end of device [ 1390.131104][ T7639] loop0: rw=1, want=131, limit=128 [ 1390.136284][ T7639] attempt to access beyond end of device [ 1390.142167][ T7615] loop2: rw=1, want=142, limit=128 [ 1390.147549][ T7615] attempt to access beyond end of device [ 1390.167143][ T7639] loop0: rw=1, want=132, limit=128 [ 1390.172626][ T7615] loop2: rw=1, want=143, limit=128 [ 1390.178134][ T7615] attempt to access beyond end of device [ 1390.188483][ T7639] attempt to access beyond end of device [ 1390.194242][ T7615] loop2: rw=1, want=144, limit=128 [ 1390.200461][ T7615] attempt to access beyond end of device [ 1390.217182][ T7615] loop2: rw=1, want=145, limit=128 [ 1390.220517][ T7603] attempt to access beyond end of device [ 1390.224810][ T7639] loop0: rw=1, want=133, limit=128 [ 1390.238009][ T7603] loop5: rw=2049, want=3625, limit=128 [ 1390.251503][ T7639] attempt to access beyond end of device 01:28:59 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x4c000000, 0x4) 01:28:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000000)=@bpq0='bpq0\x00', 0x10) chdir(&(0x7f0000000180)='./file0\x00') r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) 01:28:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000100"}) 01:28:59 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1390.265263][ T7639] loop0: rw=1, want=142, limit=128 [ 1390.319107][ T7639] attempt to access beyond end of device [ 1390.387027][ T7639] loop0: rw=1, want=143, limit=128 01:28:59 executing program 2: r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x400040, 0xc3) readahead(r0, 0x94, 0x100000000) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r1, 0x0, 0x0, 0x4) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) execveat(r3, &(0x7f0000000040)='./bus\x00', &(0x7f00000001c0)=[&(0x7f0000000080)='vfat\x00', &(0x7f00000000c0)='\x00', &(0x7f0000000100)='vfat\x00'], &(0x7f00000003c0)=[&(0x7f0000000200)='vfat\x00', &(0x7f0000000240)='vfat\x00', &(0x7f0000000280)='vfat\x00', &(0x7f0000000300)='trustednodev!/#wlan1\x00', &(0x7f0000000340)='vfat\x00', &(0x7f0000000380)='vfat\x00'], 0x1000) 01:28:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000800100"}) [ 1390.422200][ T7639] attempt to access beyond end of device [ 1390.428346][ T7639] loop0: rw=1, want=144, limit=128 [ 1390.434255][ T7639] attempt to access beyond end of device [ 1390.440846][ T7639] loop0: rw=1, want=145, limit=128 [ 1390.485722][ T7639] attempt to access beyond end of device [ 1390.502507][ T7639] loop0: rw=1, want=2193, limit=128 01:28:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000200"}) [ 1390.654548][ T7639] attempt to access beyond end of device [ 1390.760825][ T7646] attempt to access beyond end of device [ 1390.766659][ T7646] loop4: rw=2049, want=130, limit=128 [ 1390.773789][ T7646] attempt to access beyond end of device [ 1390.784390][ T7646] loop4: rw=2049, want=131, limit=128 [ 1390.791181][ T7646] attempt to access beyond end of device [ 1390.791774][ T7771] attempt to access beyond end of device [ 1390.799382][ T7646] loop4: rw=2049, want=132, limit=128 [ 1390.814221][ T7646] attempt to access beyond end of device [ 1390.824789][ T7646] loop4: rw=2049, want=133, limit=128 [ 1390.834593][ T7646] attempt to access beyond end of device [ 1390.845068][ T7646] loop4: rw=2049, want=142, limit=128 [ 1390.851162][ T7646] attempt to access beyond end of device [ 1390.857160][ T7646] loop4: rw=2049, want=143, limit=128 01:28:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000300"}) [ 1390.863275][ T7646] attempt to access beyond end of device [ 1390.869180][ T7646] loop4: rw=2049, want=144, limit=128 [ 1390.874973][ T7646] attempt to access beyond end of device [ 1390.880857][ T7646] loop4: rw=2049, want=145, limit=128 [ 1390.889340][ T7646] attempt to access beyond end of device [ 1390.895187][ T7646] loop4: rw=2049, want=1289, limit=128 01:28:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000000)=@bpq0='bpq0\x00', 0x10) chdir(&(0x7f0000000180)='./file0\x00') r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) [ 1390.923494][ T7639] loop0: rw=1, want=3929, limit=128 [ 1390.927308][ T7632] attempt to access beyond end of device [ 1390.937082][ T7771] loop5: rw=1, want=130, limit=128 [ 1390.937949][ T7776] attempt to access beyond end of device [ 1390.952885][ T7632] loop0: rw=2049, want=4097, limit=128 [ 1391.000639][ T7771] attempt to access beyond end of device 01:28:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000400"}) [ 1391.045889][ T7771] loop5: rw=1, want=131, limit=128 [ 1391.059453][ T7776] loop2: rw=1, want=130, limit=128 [ 1391.077626][ T7771] attempt to access beyond end of device [ 1391.099803][ T7776] attempt to access beyond end of device [ 1391.105628][ T7776] loop2: rw=1, want=131, limit=128 [ 1391.135312][ T7776] attempt to access beyond end of device [ 1391.171558][ T7771] loop5: rw=1, want=132, limit=128 [ 1391.230287][ T7771] attempt to access beyond end of device [ 1391.236251][ T7771] loop5: rw=1, want=133, limit=128 [ 1391.248349][ T7776] loop2: rw=1, want=132, limit=128 [ 1391.248902][ T7771] attempt to access beyond end of device [ 1391.253783][ T7776] attempt to access beyond end of device [ 1391.289979][ T7771] loop5: rw=1, want=142, limit=128 [ 1391.304427][ T7771] attempt to access beyond end of device [ 1391.337698][ T7771] loop5: rw=1, want=143, limit=128 01:29:00 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000500"}) [ 1391.362695][ T7771] attempt to access beyond end of device [ 1391.394622][ T7776] loop2: rw=1, want=133, limit=128 [ 1391.448235][ T7771] loop5: rw=1, want=144, limit=128 [ 1391.475009][ T7771] attempt to access beyond end of device [ 1391.484518][ T7776] attempt to access beyond end of device [ 1391.531927][ T7771] loop5: rw=1, want=145, limit=128 [ 1391.549892][ T7776] loop2: rw=1, want=142, limit=128 [ 1391.620910][ T7776] attempt to access beyond end of device [ 1391.627720][ T7771] attempt to access beyond end of device [ 1391.652657][ T7784] attempt to access beyond end of device [ 1391.658188][ T7776] loop2: rw=1, want=143, limit=128 [ 1391.659712][ T7771] loop5: rw=1, want=2769, limit=128 [ 1391.663902][ T7776] attempt to access beyond end of device [ 1391.676417][ T7784] loop4: rw=2049, want=130, limit=128 [ 1391.680686][ T7776] loop2: rw=1, want=144, limit=128 [ 1391.686059][ T7784] attempt to access beyond end of device [ 1391.687011][ T7776] attempt to access beyond end of device [ 1391.694928][ T7661] attempt to access beyond end of device [ 1391.704562][ T7776] loop2: rw=1, want=145, limit=128 [ 1391.705970][ T7771] attempt to access beyond end of device [ 1391.709949][ T7784] loop4: rw=2049, want=131, limit=128 [ 1391.716145][ T7661] loop2: rw=2049, want=2481, limit=128 [ 1391.721128][ T7784] attempt to access beyond end of device [ 1391.727304][ T7771] loop5: rw=1, want=3281, limit=128 [ 1391.737937][ T7784] loop4: rw=2049, want=132, limit=128 [ 1391.743947][ T7784] attempt to access beyond end of device [ 1391.753012][ T7661] attempt to access beyond end of device 01:29:00 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x60000000, 0x4) 01:29:00 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) recvmsg$can_j1939(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000080)=""/27, 0x1b}, {&(0x7f00000001c0)=""/238, 0xee}, {&(0x7f0000000340)=""/145, 0x91}, {&(0x7f00000000c0)=""/109, 0x6d}, {&(0x7f0000000400)=""/22, 0x16}, {&(0x7f0000000480)=""/165, 0xa5}, {&(0x7f00000005c0)}], 0x7, &(0x7f0000000680)=""/130, 0x82}, 0x3) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r4, 0x0, 0xffffffff) getpeername$tipc(r4, &(0x7f0000000000)=@id, &(0x7f0000000040)=0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000600"}) [ 1391.766866][ T7661] loop2: rw=2049, want=3993, limit=128 [ 1391.768135][ T7784] loop4: rw=2049, want=133, limit=128 [ 1391.777844][ T7784] attempt to access beyond end of device [ 1391.790049][ T7784] loop4: rw=2049, want=142, limit=128 [ 1391.802405][ T7784] attempt to access beyond end of device [ 1391.810297][ T7784] loop4: rw=2049, want=143, limit=128 01:29:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) [ 1391.832358][ T7784] attempt to access beyond end of device [ 1391.857138][ T7784] loop4: rw=2049, want=144, limit=128 [ 1391.938231][ T7784] attempt to access beyond end of device 01:29:00 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) lstat(0x0, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getpid() fstat(0xffffffffffffffff, 0x0) 01:29:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1391.987067][ T7784] loop4: rw=2049, want=145, limit=128 [ 1392.021107][ T7784] attempt to access beyond end of device [ 1392.026928][ T7784] loop4: rw=2049, want=1257, limit=128 01:29:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:29:00 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000000)=@bpq0='bpq0\x00', 0x10) chdir(&(0x7f0000000180)='./file0\x00') r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) 01:29:00 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1392.165420][ T7915] attempt to access beyond end of device 01:29:01 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) [ 1392.213898][ T7930] attempt to access beyond end of device [ 1392.220661][ T7915] loop5: rw=1, want=130, limit=128 01:29:01 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1392.263556][ T7930] loop0: rw=1, want=130, limit=128 [ 1392.269554][ T7915] attempt to access beyond end of device 01:29:01 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) lstat(0x0, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getpid() fstat(0xffffffffffffffff, 0x0) [ 1392.324370][ T7930] attempt to access beyond end of device [ 1392.332591][ T7915] loop5: rw=1, want=131, limit=128 [ 1392.337767][ T7915] attempt to access beyond end of device [ 1392.375198][ T7930] loop0: rw=1, want=131, limit=128 [ 1392.388180][ C0] net_ratelimit: 19 callbacks suppressed [ 1392.388188][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1392.399659][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1392.430210][ T7915] loop5: rw=1, want=132, limit=128 [ 1392.437031][ T7930] attempt to access beyond end of device [ 1392.457328][ T7915] attempt to access beyond end of device [ 1392.468205][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1392.474006][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1392.479893][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1392.485664][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1392.530407][ T7915] loop5: rw=1, want=133, limit=128 [ 1392.537344][ T7930] loop0: rw=1, want=132, limit=128 [ 1392.578425][ T7915] attempt to access beyond end of device [ 1392.587725][ T7915] loop5: rw=1, want=142, limit=128 [ 1392.599984][ T7915] attempt to access beyond end of device [ 1392.606252][ T7915] loop5: rw=1, want=143, limit=128 [ 1392.611806][ T7915] attempt to access beyond end of device [ 1392.617679][ T7915] loop5: rw=1, want=144, limit=128 [ 1392.623661][ T7915] attempt to access beyond end of device [ 1392.629802][ T7915] loop5: rw=1, want=145, limit=128 [ 1392.639770][ T7915] attempt to access beyond end of device [ 1392.640778][ T7930] attempt to access beyond end of device [ 1392.645608][ T7915] loop5: rw=1, want=1873, limit=128 [ 1392.718213][ T7930] loop0: rw=1, want=133, limit=128 [ 1392.748352][ T7930] attempt to access beyond end of device [ 1392.786168][ T7930] loop0: rw=1, want=142, limit=128 [ 1392.852554][ T7930] attempt to access beyond end of device [ 1392.871848][ T7922] attempt to access beyond end of device [ 1392.877550][ T7922] loop5: rw=2049, want=3921, limit=128 [ 1392.881833][ T7930] loop0: rw=1, want=143, limit=128 [ 1392.893778][ T7930] attempt to access beyond end of device [ 1392.896733][ T7907] attempt to access beyond end of device [ 1392.903657][ T7930] loop0: rw=1, want=144, limit=128 [ 1392.905158][ T7907] loop0: rw=2049, want=2265, limit=128 [ 1392.909810][ T7907] attempt to access beyond end of device [ 1392.913782][ T7930] attempt to access beyond end of device [ 1392.915720][ T7907] loop0: rw=2049, want=4441, limit=128 [ 1392.919785][ T7922] attempt to access beyond end of device [ 1392.924851][ T7930] loop0: rw=1, want=145, limit=128 [ 1392.927075][ T7922] loop5: rw=2049, want=4057, limit=128 01:29:01 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x68000000, 0x4) [ 1392.936772][ T7930] attempt to access beyond end of device [ 1392.948328][ T7907] attempt to access beyond end of device [ 1392.955402][ T7930] loop0: rw=1, want=5081, limit=128 [ 1392.966099][ T7907] loop0: rw=2049, want=5009, limit=128 01:29:01 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000fffffdfd00"}) 01:29:01 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) lstat(0x0, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getpid() fstat(0xffffffffffffffff, 0x0) 01:29:01 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fstat(0xffffffffffffffff, 0x0) mount$fuseblk(0x0, 0x0, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e22000d00ff0028925aa80020007b00400080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0xd8}], 0x1) r1 = gettid() ptrace$cont(0xffffffffffffffff, r1, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) 01:29:01 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) ioctl$NS_GET_OWNER_UID(r0, 0xb704, &(0x7f0000000080)=0x0) stat(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0x30f) fchownat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, r4, 0x100) lsetxattr$system_posix_acl(&(0x7f0000000000)='./bus\x00', &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000100)={{}, {}, [{0x2, 0x3, r1}, {0x2, 0x7, r2}], {0x4, 0x1}, [{0x8, 0x3, r4}], {0x10, 0x20463977ded89087}, {0x20, 0x6}}, 0x3c, 0x3) 01:29:01 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000ff00"}) 01:29:01 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) lstat(0x0, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getpid() fstat(0xffffffffffffffff, 0x0) 01:29:02 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) close(r1) 01:29:02 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000fdfdffff00"}) 01:29:02 executing program 4: select(0x7e764d91726b6591, &(0x7f00000004c0)={0xdeafbead}, 0x0, 0x0, 0x0) 01:29:02 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) lstat(0x0, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) getpid() [ 1393.347364][ T8179] attempt to access beyond end of device [ 1393.359337][ T8179] loop5: rw=1, want=130, limit=128 [ 1393.539444][ T8179] buffer_io_error: 78 callbacks suppressed [ 1393.539457][ T8179] Buffer I/O error on dev loop5, logical block 129, lost async page write 01:29:02 executing program 4: socket(0x0, 0x803, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x2, r4}]]}}}]}, 0x38}}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newlink={0x38, 0x10, 0x43b, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x2, r6}]]}}}]}, 0x38}}, 0x0) [ 1393.588208][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1393.588245][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1393.594019][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1393.598551][ T8179] attempt to access beyond end of device [ 1393.729697][ T8179] loop5: rw=1, want=131, limit=128 [ 1393.744894][ T8179] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1393.792318][ T8179] attempt to access beyond end of device [ 1393.815011][ T8179] loop5: rw=1, want=132, limit=128 [ 1393.856399][ T8179] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1393.887347][ T8179] attempt to access beyond end of device [ 1393.907121][ T8179] loop5: rw=1, want=133, limit=128 [ 1393.914783][ T8179] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1393.930238][ T8179] attempt to access beyond end of device [ 1393.949956][ T8179] loop5: rw=1, want=142, limit=128 [ 1393.973012][ T8179] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1393.989721][ T8179] attempt to access beyond end of device [ 1394.001112][ T8179] loop5: rw=1, want=143, limit=128 [ 1394.013466][ T8179] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1394.039383][ T8066] attempt to access beyond end of device [ 1394.048945][ T8179] attempt to access beyond end of device [ 1394.054604][ T8179] loop5: rw=1, want=144, limit=128 [ 1394.055572][ T8066] loop5: rw=2049, want=2257, limit=128 [ 1394.094375][ T8066] attempt to access beyond end of device [ 1394.101135][ T8066] loop5: rw=2049, want=6305, limit=128 [ 1394.113768][ T8179] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1394.139889][ T8179] attempt to access beyond end of device [ 1394.145806][ T8179] loop5: rw=1, want=145, limit=128 [ 1394.151849][ T8179] Buffer I/O error on dev loop5, logical block 144, lost async page write 01:29:02 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x6c000000, 0x4) 01:29:02 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000100"}) 01:29:02 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) lstat(0x0, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) 01:29:02 executing program 4: ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x5ea45bbde364b00b}) mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vcsa(&(0x7f00000002c0)='/dev/vcsa\x00', 0x0, 0x2) pivot_root(&(0x7f0000000040)='./file0\x00', &(0x7f0000000200)='./file0\x00') socket$inet6(0xa, 0x1, 0x0) syz_emit_ethernet(0x76, &(0x7f00000002c0)={@broadcast, @random="708a1c045afe", [], {@ipv6={0x86dd, {0x0, 0x6, "4c000f", 0x40, 0x3a, 0x0, @dev, @mcast2, {[], @icmpv6=@dest_unreach={0x2, 0x0, 0x0, 0x0, [], {0x0, 0x6, '\x00', 0x0, 0x0, 0x0, @empty, @remote, [@hopopts={0x2f}], "02006558000000fc"}}}}}}}, 0x0) io_setup(0x1, &(0x7f00000000c0)) r1 = socket$inet6(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, r1, 0x80000) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r1, &(0x7f0000003a40)={0xa, 0x0, 0x0, @remote}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xbb8) getsockname$packet(r0, &(0x7f0000001c40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001c80)=0x14) r3 = getuid() setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000001cc0)={{{@in=@rand_addr=0x46f4, @in=@empty, 0x4e21, 0x0, 0x4e22, 0x7, 0xa, 0x80, 0x0, 0xc, r2, r3}, {0x1, 0xd025, 0x9, 0x2, 0x9, 0x101, 0x0, 0x5}, {0xfffffffffffffffb, 0x0, 0x7}, 0x0, 0x6e6bbe, 0x0, 0x0, 0x1, 0x3}, {{@in6=@local, 0x4d6, 0x33}, 0x2, @in6=@local, 0x0, 0x3cc3ec57535bafd3, 0x0, 0x9, 0x3, 0x3f, 0x7f}}, 0xe4) io_setup(0x14ec, &(0x7f0000000180)=0x0) io_submit(r4, 0x1, &(0x7f0000000740)=[0x0]) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) r6 = socket(0x11, 0x800000003, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r6, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) bind$packet(r5, &(0x7f0000000000), 0x14) sendmmsg(0xffffffffffffffff, &(0x7f0000000d00), 0x400004e, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000005c0)='TIPC\x00') 01:29:03 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, 0x0, 0xffffffff) getsockopt$inet6_mtu(r4, 0x29, 0x17, &(0x7f0000000080), &(0x7f00000000c0)=0x4) sendfile(r1, r2, 0x0, 0xffffffff) fsetxattr(r1, &(0x7f0000000000)=@known='trusted.overlay.impure\x00', &(0x7f0000000040)='vfat\x00', 0x5, 0x3) 01:29:03 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000800100"}) 01:29:03 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) lstat(0x0, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) 01:29:03 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) close(r1) [ 1394.388152][ C1] protocol 88fb is buggy, dev hsr_slave_0 01:29:03 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000200"}) 01:29:03 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) lstat(0x0, 0x0) 01:29:03 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000300"}) 01:29:03 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x74000000, 0x4) 01:29:03 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() syz_open_procfs$namespace(0x0, 0x0) 01:29:04 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000400"}) 01:29:04 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) getpid() [ 1395.564891][ T8463] attempt to access beyond end of device [ 1395.620418][ T8463] loop5: rw=1, want=130, limit=128 [ 1395.698919][ T8463] Buffer I/O error on dev loop5, logical block 129, lost async page write 01:29:04 executing program 4: openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x101001, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000140), 0x10) setsockopt(r0, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r0) unshare(0x40000400) [ 1395.802432][ T8463] attempt to access beyond end of device [ 1395.870913][ T8463] loop5: rw=1, want=131, limit=128 [ 1395.903319][ T8463] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1395.948272][ T8463] attempt to access beyond end of device [ 1395.968211][ T8463] loop5: rw=1, want=132, limit=128 [ 1395.977337][ T8463] attempt to access beyond end of device [ 1396.009030][ T8463] loop5: rw=1, want=133, limit=128 [ 1396.028593][ T8463] attempt to access beyond end of device [ 1396.039432][ T8474] IPVS: ftp: loaded support on port[0] = 21 [ 1396.048586][ T8463] loop5: rw=1, want=142, limit=128 [ 1396.073456][ T8463] attempt to access beyond end of device [ 1396.104418][ T8463] loop5: rw=1, want=143, limit=128 [ 1396.118229][ T8463] attempt to access beyond end of device [ 1396.138693][ T8463] loop5: rw=1, want=144, limit=128 [ 1396.155583][ T8463] attempt to access beyond end of device [ 1396.194351][ T8463] loop5: rw=1, want=145, limit=128 01:29:05 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) close(r1) 01:29:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000500"}) 01:29:05 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) [ 1396.284616][ T8463] attempt to access beyond end of device [ 1396.338174][ T8463] loop5: rw=1, want=4449, limit=128 01:29:05 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16, 0x5d}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000080)={0x6, &(0x7f0000000000)=[{0x2, 0x20, 0x1, 0xd1}, {0x0, 0x86, 0x81, 0x1}, {0x3, 0x8, 0x3}, {0x6, 0x8, 0x6, 0x3f}, {0x5, 0x0, 0x7e}, {0xbdb5, 0x44, 0x9, 0xda}]}) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr="d838ed6e052b6211218092bbe1933bfd"}]}, &(0x7f0000000180)=0x10) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) socket$unix(0x1, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000200)={r5, @in6={{0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000100)={r5, 0x2b}, 0x8) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r6, r7, 0x0, 0xffffffff) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x30) ftruncate(r6, 0x17d) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) [ 1396.370097][ T8457] attempt to access beyond end of device [ 1396.386085][ T8463] attempt to access beyond end of device [ 1396.407378][ T8457] loop5: rw=2049, want=5017, limit=128 01:29:05 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) 01:29:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000600"}) [ 1396.455143][ T8463] loop5: rw=1, want=4457, limit=128 [ 1396.546663][ T8488] FAT-fs (loop0): bogus number of reserved sectors [ 1396.622684][ T8488] FAT-fs (loop0): Can't find a valid FAT filesystem 01:29:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:29:05 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) lchown(0x0, 0x0, 0x0) 01:29:05 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x7a000000, 0x4) 01:29:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:29:05 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) [ 1397.410745][ T8497] FAT-fs (loop0): bogus number of reserved sectors [ 1397.499612][ T8497] FAT-fs (loop0): Can't find a valid FAT filesystem 01:29:06 executing program 4: openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x101001, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000140), 0x10) setsockopt(r0, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r0) unshare(0x40000400) 01:29:06 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:29:06 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) close(r1) 01:29:06 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) close(r0) [ 1397.748200][ C0] net_ratelimit: 19 callbacks suppressed [ 1397.748209][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1397.758192][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1397.759712][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1397.765397][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1397.799400][ T223] tipc: TX() has been purged, node left! 01:29:06 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) renameat(r0, &(0x7f0000000000)='./file0\x00', r2, &(0x7f0000000040)='./bus\x00') write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:06 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0xcf010000, 0x4) 01:29:06 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:29:06 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) close(r0) 01:29:06 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) close(r0) 01:29:06 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) [ 1398.008543][ T8755] attempt to access beyond end of device [ 1398.100766][ T8755] loop5: rw=1, want=130, limit=128 01:29:06 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000fffffdfd00"}) [ 1398.131395][ T8755] attempt to access beyond end of device [ 1398.137070][ T8755] loop5: rw=1, want=131, limit=128 01:29:06 executing program 2: bind$x25(0xffffffffffffffff, &(0x7f0000000000), 0x12) close(0xffffffffffffffff) [ 1398.202188][ T8764] attempt to access beyond end of device [ 1398.234279][ T8764] loop0: rw=1, want=130, limit=128 [ 1398.257454][ T8755] attempt to access beyond end of device [ 1398.269322][ T8764] attempt to access beyond end of device [ 1398.308230][ T8755] loop5: rw=1, want=132, limit=128 [ 1398.310266][ T8764] loop0: rw=1, want=131, limit=128 [ 1398.316020][ T8755] attempt to access beyond end of device [ 1398.341739][ T8755] loop5: rw=1, want=133, limit=128 [ 1398.355392][ T8755] attempt to access beyond end of device [ 1398.364781][ T8755] loop5: rw=1, want=142, limit=128 [ 1398.373455][ T8755] attempt to access beyond end of device [ 1398.379898][ T8764] attempt to access beyond end of device [ 1398.400729][ T8764] loop0: rw=1, want=132, limit=128 [ 1398.406319][ T8764] attempt to access beyond end of device [ 1398.416496][ T8755] loop5: rw=1, want=143, limit=128 [ 1398.424647][ T8755] attempt to access beyond end of device [ 1398.452875][ T8764] loop0: rw=1, want=133, limit=128 [ 1398.460545][ T8755] loop5: rw=1, want=144, limit=128 [ 1398.465715][ T8755] attempt to access beyond end of device [ 1398.465731][ T8755] loop5: rw=1, want=145, limit=128 [ 1398.483436][ T8764] attempt to access beyond end of device [ 1398.506748][ T8755] attempt to access beyond end of device [ 1398.513635][ T8764] loop0: rw=1, want=142, limit=128 [ 1398.547340][ T8764] attempt to access beyond end of device [ 1398.558163][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1398.564031][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1398.569075][ T8755] loop5: rw=1, want=2329, limit=128 [ 1398.603349][ T8764] loop0: rw=1, want=143, limit=128 [ 1398.626139][ T8755] attempt to access beyond end of device [ 1398.632000][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1398.632058][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1398.650156][ T8764] buffer_io_error: 19 callbacks suppressed [ 1398.650186][ T8764] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1398.692420][ T8755] loop5: rw=1, want=4153, limit=128 [ 1398.699490][ T8764] attempt to access beyond end of device [ 1398.708224][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1398.714021][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1398.716769][ T8764] loop0: rw=1, want=144, limit=128 [ 1398.729950][ T8764] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1398.773589][ T8764] attempt to access beyond end of device [ 1398.811104][ T8745] attempt to access beyond end of device [ 1398.825471][ T8764] loop0: rw=1, want=145, limit=128 [ 1398.830799][ T8745] loop5: rw=2049, want=5889, limit=128 [ 1398.837077][ T8764] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1398.883356][ T8764] attempt to access beyond end of device [ 1398.904299][ T8764] loop0: rw=1, want=2249, limit=128 [ 1398.916991][ T8764] attempt to access beyond end of device [ 1398.924851][ T8764] loop0: rw=1, want=2409, limit=128 [ 1398.934615][ T8753] attempt to access beyond end of device [ 1398.940650][ T8753] loop0: rw=2049, want=2497, limit=128 [ 1398.946496][ T8764] attempt to access beyond end of device [ 1398.953259][ T8764] loop0: rw=1, want=2529, limit=128 [ 1398.961825][ T8753] attempt to access beyond end of device [ 1398.967546][ T8753] loop0: rw=2049, want=2617, limit=128 [ 1398.975704][ T8764] attempt to access beyond end of device [ 1398.986798][ T8764] loop0: rw=1, want=4449, limit=128 [ 1398.993940][ T8753] attempt to access beyond end of device [ 1399.000470][ T8753] loop0: rw=2049, want=5049, limit=128 [ 1399.006566][ T8764] attempt to access beyond end of device [ 1399.024806][ T8764] loop0: rw=1, want=5057, limit=128 [ 1399.031616][ T8753] attempt to access beyond end of device [ 1399.037430][ T8753] loop0: rw=2049, want=5065, limit=128 [ 1399.043504][ T8764] attempt to access beyond end of device [ 1399.049665][ T8764] loop0: rw=1, want=5073, limit=128 [ 1399.057372][ T8764] attempt to access beyond end of device [ 1399.063294][ T8764] loop0: rw=1, want=7737, limit=128 [ 1399.070874][ T8753] attempt to access beyond end of device [ 1399.076555][ T8753] loop0: rw=2049, want=5081, limit=128 [ 1399.082588][ T8764] attempt to access beyond end of device [ 1399.089558][ T8764] loop0: rw=1, want=7745, limit=128 [ 1399.095223][ T8753] attempt to access beyond end of device [ 1399.100964][ T8753] loop0: rw=2049, want=7857, limit=128 [ 1399.106631][ T8764] attempt to access beyond end of device [ 1399.113160][ T8764] loop0: rw=1, want=7953, limit=128 [ 1399.119711][ T8753] attempt to access beyond end of device [ 1399.125454][ T8753] loop0: rw=2049, want=7977, limit=128 [ 1399.133647][ T8753] attempt to access beyond end of device [ 1399.137084][ T8764] attempt to access beyond end of device [ 1399.140321][ T8753] loop0: rw=2049, want=9529, limit=128 [ 1399.145727][ T8764] loop0: rw=1, want=8193, limit=128 01:29:10 executing program 4: openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x101001, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000140), 0x10) setsockopt(r0, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r0) unshare(0x40000400) 01:29:10 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000ff00"}) 01:29:10 executing program 2: bind$x25(0xffffffffffffffff, &(0x7f0000000000), 0x12) close(0xffffffffffffffff) 01:29:10 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) close(r1) 01:29:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0xfffdffff, 0x4) 01:29:10 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:10 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000ffffffff00"}) [ 1401.587449][ T8795] attempt to access beyond end of device 01:29:10 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000200"}) [ 1401.706877][ T8795] loop0: rw=1, want=130, limit=128 01:29:10 executing program 2: bind$x25(0xffffffffffffffff, &(0x7f0000000000), 0x12) close(0xffffffffffffffff) [ 1401.765295][ T8806] attempt to access beyond end of device [ 1401.802540][ T8795] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1401.804546][ T8806] loop5: rw=1, want=130, limit=128 01:29:10 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000300"}) [ 1401.880638][ T8806] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1401.889769][ T8795] attempt to access beyond end of device [ 1401.899346][ T8795] loop0: rw=1, want=131, limit=128 [ 1401.924408][ T8795] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1401.963414][ T8795] attempt to access beyond end of device [ 1401.983445][ T8806] attempt to access beyond end of device [ 1401.993045][ T8795] loop0: rw=1, want=132, limit=128 [ 1402.005875][ T8806] loop5: rw=1, want=131, limit=128 [ 1402.013884][ T8795] Buffer I/O error on dev loop0, logical block 131, lost async page write 01:29:10 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000400"}) 01:29:10 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(0xffffffffffffffff, &(0x7f0000000000), 0x12) close(r0) [ 1402.030802][ T8806] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1402.048623][ T8795] attempt to access beyond end of device [ 1402.089312][ T8806] attempt to access beyond end of device [ 1402.111329][ T8795] loop0: rw=1, want=133, limit=128 [ 1402.115524][ T8804] IPVS: ftp: loaded support on port[0] = 21 [ 1402.126332][ T8806] loop5: rw=1, want=132, limit=128 [ 1402.132953][ T8795] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1402.172477][ T8806] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1402.228914][ T8795] attempt to access beyond end of device [ 1402.235145][ T8806] attempt to access beyond end of device [ 1402.250205][ T8795] loop0: rw=1, want=142, limit=128 [ 1402.267119][ T8806] loop5: rw=1, want=133, limit=128 [ 1402.282058][ T8795] attempt to access beyond end of device [ 1402.320699][ T8806] attempt to access beyond end of device [ 1402.351710][ T8795] loop0: rw=1, want=143, limit=128 [ 1402.384132][ T8806] loop5: rw=1, want=142, limit=128 [ 1402.392554][ T8795] attempt to access beyond end of device [ 1402.400148][ T8806] attempt to access beyond end of device [ 1402.419601][ T8795] loop0: rw=1, want=144, limit=128 [ 1402.450715][ T8806] loop5: rw=1, want=143, limit=128 [ 1402.493459][ T8795] attempt to access beyond end of device [ 1402.515191][ T8795] loop0: rw=1, want=145, limit=128 [ 1402.534825][ T8806] attempt to access beyond end of device [ 1402.537410][ T8791] attempt to access beyond end of device [ 1402.541113][ T8786] attempt to access beyond end of device [ 1402.553838][ T8806] loop5: rw=1, want=144, limit=128 [ 1402.560526][ T8786] loop0: rw=2049, want=2281, limit=128 [ 1402.566179][ T8806] attempt to access beyond end of device [ 1402.568396][ T8791] loop5: rw=2049, want=2249, limit=128 [ 1402.578811][ T8795] attempt to access beyond end of device [ 1402.584611][ T8806] loop5: rw=1, want=145, limit=128 [ 1402.590360][ T8786] attempt to access beyond end of device [ 1402.596737][ T8795] loop0: rw=1, want=4337, limit=128 [ 1402.602486][ T8786] loop0: rw=2049, want=2289, limit=128 [ 1402.605132][ T8791] attempt to access beyond end of device [ 1402.689652][ T8791] loop5: rw=2049, want=2625, limit=128 [ 1402.788153][ C0] net_ratelimit: 20 callbacks suppressed [ 1402.788161][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1402.793871][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1402.868216][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1402.874052][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1402.879914][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1402.879972][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:29:12 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000ac0)={'syz0\x00', {}, 0x51}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000001f40)={'syz0\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000]}, 0x45c) 01:29:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000500"}) 01:29:12 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(0xffffffffffffffff, &(0x7f0000000000), 0x12) close(r0) 01:29:12 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) close(r1) 01:29:12 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x92, @ipv4={[], [], @multicast1}}, 0xffffffffffffff2e) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) r2 = fcntl$dupfd(0xffffffffffffffff, 0x406, r0) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000000), &(0x7f0000000040)=0x4) r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f00000000c0)="9e951100efb21c9d4a7313cdb87fa1393042c352370069060be58ae1daf0ef3e56596f98ad9c001bfd14acb1343cbd7eabb6c560c248e49d16e21a4a10f32f7d10cb14", 0x43}], 0x1) write$UHID_INPUT(r3, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r3, 0x0, 0x0, 0x4) r4 = syz_open_dev$cec(&(0x7f0000000200)='/dev/cec#\x00', 0x1, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000280)={0xfffffff, 0x88, 0x4, r4, 0x0, &(0x7f0000000240)={0x980922, 0x0, [], @ptr=0x8}}) 01:29:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0xfffffdff, 0x4) 01:29:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000600"}) [ 1403.667036][ T8853] attempt to access beyond end of device [ 1403.672687][ T307] tipc: TX() has been purged, node left! [ 1403.683880][ T8855] attempt to access beyond end of device [ 1403.688626][ T8853] loop5: rw=1, want=130, limit=128 [ 1403.713252][ T8855] loop0: rw=1, want=130, limit=128 [ 1403.731075][ T8855] buffer_io_error: 9 callbacks suppressed [ 1403.731092][ T8855] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1403.752752][ T8855] attempt to access beyond end of device 01:29:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) [ 1403.760187][ T8853] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1403.772549][ T8855] loop0: rw=1, want=131, limit=128 [ 1403.787855][ T8855] Buffer I/O error on dev loop0, logical block 130, lost async page write 01:29:12 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(0xffffffffffffffff, &(0x7f0000000000), 0x12) close(r0) [ 1403.814007][ T8855] attempt to access beyond end of device 01:29:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1403.844073][ T8855] loop0: rw=1, want=132, limit=128 [ 1403.896694][ T8854] input: syz0 as /devices/virtual/input/input8 [ 1403.925643][ T8853] attempt to access beyond end of device [ 1403.942443][ T8855] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1403.955073][ T8853] loop5: rw=1, want=131, limit=128 01:29:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:29:12 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, 0x0, 0x0) close(r0) [ 1403.988178][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1403.988218][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1403.993979][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1404.018887][ T8853] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1404.079209][ T8855] attempt to access beyond end of device [ 1404.120110][ T8853] attempt to access beyond end of device [ 1404.167035][ T8853] loop5: rw=1, want=132, limit=128 [ 1404.181284][ T8855] loop0: rw=1, want=133, limit=128 [ 1404.185522][ T8853] Buffer I/O error on dev loop5, logical block 131, lost async page write 01:29:12 executing program 4: 01:29:12 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, 0x0, 0x0) close(r0) 01:29:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000800100"}) [ 1404.215885][ T8855] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1404.229828][ T8853] attempt to access beyond end of device [ 1404.248248][ T8853] loop5: rw=1, want=133, limit=128 [ 1404.285630][ T8855] attempt to access beyond end of device 01:29:13 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r1) [ 1404.348123][ T8853] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1404.356697][ T8853] attempt to access beyond end of device [ 1404.480065][ T8855] loop0: rw=1, want=142, limit=128 [ 1404.522360][ T8853] loop5: rw=1, want=142, limit=128 [ 1404.544273][ T8855] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1404.558712][ T8845] attempt to access beyond end of device [ 1404.566231][ T8855] attempt to access beyond end of device [ 1404.598661][ T8853] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1404.633933][ T8855] loop0: rw=1, want=143, limit=128 [ 1404.640761][ T8845] loop5: rw=2049, want=2201, limit=128 [ 1404.646712][ T8853] attempt to access beyond end of device [ 1404.652920][ T8855] attempt to access beyond end of device [ 1404.669842][ T8842] attempt to access beyond end of device [ 1404.672863][ T8845] attempt to access beyond end of device [ 1404.675560][ T8842] loop0: rw=2049, want=2193, limit=128 [ 1404.681685][ T8853] loop5: rw=1, want=143, limit=128 [ 1404.692500][ T8855] loop0: rw=1, want=144, limit=128 [ 1404.696229][ T8842] attempt to access beyond end of device [ 1404.697757][ T8855] attempt to access beyond end of device [ 1404.708567][ T8842] loop0: rw=2049, want=3593, limit=128 [ 1404.709630][ T8845] loop5: rw=2049, want=3881, limit=128 [ 1404.720409][ T8853] attempt to access beyond end of device [ 1404.726033][ T8853] loop5: rw=1, want=144, limit=128 [ 1404.731217][ T8855] loop0: rw=1, want=145, limit=128 [ 1404.738610][ T8853] attempt to access beyond end of device [ 1404.744257][ T8853] loop5: rw=1, want=145, limit=128 01:29:13 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x6a50}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) write$P9_RATTACH(r0, &(0x7f0000000000)={0x14, 0x69, 0x1, {0x40, 0x2, 0x4}}, 0x14) 01:29:13 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x88000000000000, 0x4) 01:29:13 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, 0x0, 0x0) close(r0) 01:29:13 executing program 4: 01:29:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000300"}) [ 1404.788176][ C1] protocol 88fb is buggy, dev hsr_slave_0 01:29:13 executing program 4: 01:29:13 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(0xffffffffffffffff) 01:29:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000500"}) 01:29:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000600"}) [ 1405.103117][ T9021] attempt to access beyond end of device [ 1405.122136][ T9021] loop5: rw=1, want=130, limit=128 [ 1405.169815][ T9021] attempt to access beyond end of device [ 1405.169833][ T9021] loop5: rw=1, want=131, limit=128 01:29:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:29:14 executing program 4: [ 1405.318199][ T9021] attempt to access beyond end of device 01:29:14 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r1) [ 1405.391210][ T9021] loop5: rw=1, want=132, limit=128 01:29:14 executing program 0: prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f00000001c0)="e4b05d3e4c83cce8481085b77bb89e5eb7e7c05df7bac006d47cbe96aec11bdf2b05f8bcc260a1ac2956c3ea5d1d68ee6e83f0352261af47d15a8a77c09e121d94cbfacce317cb474223e14cb66d3a6b57d9f10bae764e130ba429a6f9f0521642a2900c77d0f9818c1bd27b014a3e2da52f854d61c7a3c8165a64b8a2364b268e0c63026ddd781fca38f12895fee7637d6bbb68666f1ebbbfccebcc944a8a42fc", 0xa1) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000004c0)=0x8001, 0x4) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) r4 = openat$cgroup_ro(r3, &(0x7f0000000340)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r4, 0xc0bc5310, &(0x7f0000000380)) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000480)) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000040)={0x7f, 0xc, 0x4, 0x2bb2156b48063999, 0x1, {r0, r1/1000+10000}, {0x4, 0xc, 0x3, 0xe1, 0x81, 0x2, "34269a0c"}, 0x0, 0x4, @userptr=0x9, 0x6, 0x0, 0xffffffffffffffff}) getsockopt$ARPT_SO_GET_REVISION_TARGET(r5, 0x0, 0x63, &(0x7f00000000c0)={'ah\x00'}, &(0x7f0000000100)=0x1e) r6 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r6, &(0x7f00000015c0), 0x10000005c) r7 = open(&(0x7f00000005c0)='./bus\x00', 0x4000, 0x80) ioctl$MON_IOCQ_RING_SIZE(r7, 0x9205) connect$tipc(r5, &(0x7f0000000500)=@name={0x1e, 0x2, 0x4, {{0x43, 0x1}, 0x1}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34c, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffa}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nvme-fabrics\x00', 0x2000, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r8, 0x8982, &(0x7f0000000300)={0x3, 'gre0\x00', {0x3}, 0x2}) fadvise64(r6, 0x0, 0x0, 0x4) [ 1405.478366][ T9021] attempt to access beyond end of device [ 1405.506489][ T9021] loop5: rw=1, want=133, limit=128 [ 1405.527229][ T9021] attempt to access beyond end of device [ 1405.541948][ T9021] loop5: rw=1, want=142, limit=128 [ 1405.583168][ T9021] attempt to access beyond end of device [ 1405.615485][ T9021] loop5: rw=1, want=143, limit=128 [ 1405.642370][ T9021] attempt to access beyond end of device [ 1405.651059][ T9021] loop5: rw=1, want=144, limit=128 [ 1405.678587][ T9021] attempt to access beyond end of device [ 1405.708302][ T9021] loop5: rw=1, want=145, limit=128 [ 1405.725310][ T9021] attempt to access beyond end of device [ 1405.733441][ T9021] loop5: rw=1, want=2193, limit=128 [ 1405.752740][ T9021] attempt to access beyond end of device [ 1405.758786][ T9021] loop5: rw=1, want=4241, limit=128 [ 1405.766897][ T9021] attempt to access beyond end of device [ 1405.773157][ T9021] loop5: rw=1, want=4817, limit=128 [ 1405.860258][ T9046] attempt to access beyond end of device [ 1405.876476][ T9011] attempt to access beyond end of device [ 1405.885806][ T9011] loop5: rw=2049, want=5617, limit=128 [ 1405.888193][ T9046] loop0: rw=1, want=130, limit=128 [ 1405.897069][ T9046] attempt to access beyond end of device [ 1405.903224][ T9046] loop0: rw=1, want=131, limit=128 01:29:14 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x100000000000000, 0x4) 01:29:14 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(0xffffffffffffffff) 01:29:14 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:29:14 executing program 4: [ 1405.915600][ T9046] attempt to access beyond end of device [ 1405.968310][ T9046] loop0: rw=1, want=132, limit=128 [ 1405.993796][ T9046] attempt to access beyond end of device 01:29:14 executing program 4: 01:29:14 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(0xffffffffffffffff) 01:29:14 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1406.042337][ T9046] loop0: rw=1, want=133, limit=128 [ 1406.111019][ T9046] attempt to access beyond end of device 01:29:14 executing program 4: socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000006e40)='/dev/dlm_plock\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) pselect6(0x40, &(0x7f00000000c0)={0xf3}, 0x0, 0x0, 0x0, 0x0) [ 1406.178357][ T9046] loop0: rw=1, want=142, limit=128 [ 1406.206367][ T9065] attempt to access beyond end of device [ 1406.244132][ T9046] attempt to access beyond end of device [ 1406.301559][ T9065] loop5: rw=1, want=130, limit=128 [ 1406.307922][ T9046] loop0: rw=1, want=143, limit=128 01:29:15 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:29:15 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r1) [ 1406.348571][ T9065] attempt to access beyond end of device [ 1406.365169][ T9046] attempt to access beyond end of device [ 1406.408164][ T9065] loop5: rw=1, want=131, limit=128 01:29:15 executing program 2: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r0, &(0x7f0000000000), 0x12) close(r0) socket$packet(0x11, 0x0, 0x300) lchown(0x0, 0x0, 0x0) tkill(0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socket(0x0, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) lstat(0x0, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) [ 1406.451552][ T9065] attempt to access beyond end of device [ 1406.473759][ T9046] loop0: rw=1, want=144, limit=128 [ 1406.528200][ T9065] loop5: rw=1, want=132, limit=128 [ 1406.600783][ T9065] attempt to access beyond end of device [ 1406.607222][ T9046] attempt to access beyond end of device [ 1406.643080][ T9065] loop5: rw=1, want=133, limit=128 [ 1406.680967][ T9065] attempt to access beyond end of device [ 1406.692300][ T27] audit: type=1804 audit(1577150955.433:84): pid=9045 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir131280466/syzkaller.9jjgc4/1473/file0/bus" dev="loop0" ino=476 res=1 [ 1406.741195][ T9041] attempt to access beyond end of device [ 1406.758357][ T9065] loop5: rw=1, want=142, limit=128 [ 1406.764746][ T9046] loop0: rw=1, want=145, limit=128 [ 1406.778520][ T9065] attempt to access beyond end of device [ 1406.778537][ T9065] loop5: rw=1, want=143, limit=128 [ 1406.792772][ T9041] loop0: rw=2049, want=2209, limit=128 [ 1406.807354][ T27] audit: type=1804 audit(1577150955.433:85): pid=9176 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir131280466/syzkaller.9jjgc4/1473/file0/bus" dev="loop0" ino=476 res=1 [ 1406.823363][ T9065] attempt to access beyond end of device [ 1406.845203][ T9065] loop5: rw=1, want=144, limit=128 [ 1406.862733][ T9046] attempt to access beyond end of device [ 1406.874300][ T9046] loop0: rw=1, want=4265, limit=128 [ 1406.885530][ T9065] attempt to access beyond end of device [ 1406.888008][ T9041] attempt to access beyond end of device [ 1406.898339][ T27] audit: type=1804 audit(1577150955.433:86): pid=9110 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir131280466/syzkaller.9jjgc4/1473/file0/bus" dev="loop0" ino=476 res=1 [ 1406.908605][ T9065] loop5: rw=1, want=145, limit=128 [ 1406.924452][ T9041] loop0: rw=2049, want=2217, limit=128 [ 1406.937391][ T9046] attempt to access beyond end of device [ 1406.946691][ T9046] loop0: rw=1, want=4273, limit=128 [ 1406.956866][ T9041] attempt to access beyond end of device [ 1406.966158][ T9041] loop0: rw=2049, want=4857, limit=128 [ 1406.982011][ T9046] attempt to access beyond end of device [ 1406.989688][ T9065] attempt to access beyond end of device [ 1406.995406][ T9046] loop0: rw=1, want=4865, limit=128 [ 1407.001164][ T9041] attempt to access beyond end of device [ 1407.008026][ T9041] loop0: rw=2049, want=4873, limit=128 [ 1407.025110][ T9046] attempt to access beyond end of device [ 1407.032349][ T9065] loop5: rw=1, want=3169, limit=128 [ 1407.044374][ T9046] loop0: rw=1, want=4881, limit=128 [ 1407.062602][ T9057] attempt to access beyond end of device [ 1407.068929][ T9041] attempt to access beyond end of device [ 1407.074778][ T9041] loop0: rw=2049, want=4889, limit=128 [ 1407.078173][ T9065] attempt to access beyond end of device [ 1407.085859][ T9065] loop5: rw=1, want=3177, limit=128 [ 1407.091203][ T9046] attempt to access beyond end of device [ 1407.096839][ T9046] loop0: rw=1, want=5217, limit=128 [ 1407.103409][ T9057] loop5: rw=2049, want=4065, limit=128 [ 1407.126494][ T9046] attempt to access beyond end of device [ 1407.134042][ T9041] attempt to access beyond end of device [ 1407.146691][ T9041] loop0: rw=2049, want=7481, limit=128 [ 1407.153498][ T9046] loop0: rw=1, want=7601, limit=128 01:29:16 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000ff00"}) 01:29:16 executing program 4: socket(0x10, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newlink={0x38, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, r3}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x2, r4}]]}}}]}, 0x38}}, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newlink={0x38, 0x10, 0x43b, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_LINK={0x8, 0x2, r6}]]}}}]}, 0x38}}, 0x0) 01:29:16 executing program 2: r0 = syz_open_dev$media(&(0x7f0000000140)='/dev/media#\x00', 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0xc01c7c02, 0x0) 01:29:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x200000000000000, 0x4) 01:29:16 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(0xffffffffffffffff) 01:29:16 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)={0x14, 0x8, 0x400, 0xe340, 0x40, 0x1, 0x800, [], 0x0, 0xffffffffffffffff, 0x4, 0x2}, 0x3c) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000001780)={&(0x7f0000001700)='./bus\x00', r0}, 0x10) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b64732e666174000204010002000270fff8", 0xfffffea3}], 0x90000, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) fspick(r1, &(0x7f0000000040)='./bus\x00', 0x1) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) r3 = syz_open_dev$video4linux(&(0x7f00000000c0)='/dev/v4l-subdev#\x00', 0x0, 0x0) get_thread_area(&(0x7f00000017c0)={0x3ff, 0x1000, 0x4000, 0x1, 0x3, 0x1, 0x1}) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0x4020565a, &(0x7f00000002c0)={0x0, 0x0, "49c785b660618b0c88baa6e981cd000000000000000700000000000000000080"}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000500)={0x4, 0x0, 0xe0, 0xfd, 0x2, 0x2, 0x6}, 0xc) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r5, r5, 0x0) syz_mount_image$jfs(&(0x7f00000000c0)='jfs\x00', &(0x7f0000000100)='./bus\x00', 0x8, 0x5, &(0x7f0000000480)=[{&(0x7f00000001c0)="d37e06f3abb35070200ef075c68f", 0xe, 0x101}, {&(0x7f00000005c0)="89fcaab8027c2636025926bca09a1ab31cbf843a40161c708180fb5658df1210f1a17174c9e0fcef6889ff5d8e6c5e66abb60e4b876d76f9992bf8dc6d744362d0c9cbec17373c9fc802df7e9c0fd8f377cdcc4080de786b63a3325f203672b01a327c34c16f1965f909d5e169b883b2ad40e8a932ef4093d80d9e6544ac776956054f48b31b30a8a851aaa9e3d06052d670d64fa04be756f182102430342e91d529f2e74dad84ea65ecde4379157b83871a1df5645d5ffd41afb3dbbd856bce223c404c133950068801c6274b5d70455ff23551c19d819a8786645dab014c9d1d96a056f8d96f3ab591b40ba2fa7e87c439bd706ed54c6edeb202483faf900fb6cf67c51d949a1e4ced2095e0afb505c1cbafae3602fa2b8b809d1d1645c94b2fd6ac1c70e427fdd6310ed9a315d0cedf80c9d481ea5b97f394e01fd893a1e50513214c66a47dc2a31528e8926c44588d6ff6e2b518df8e378e7fcea30aea73736fd90ea6b09a5dbab8a5f5604273ffe7dce2142e687ad656473347f3534db99d71fd5716d6b9cd2269c671606e3771f0d0e40ce74db2004b6fb158d13416d660f1b1b6f5aaaa49be0790493f62f0e86f4a6006025ad0e60fba94a5b86eef31e5b9f23bb76e7fbec5e748ee3a4cebd47c72bde521c73357e00b800b6054ed95f2816013af7b52098227e9f53e34b9057881e27033f3dbc55446d7d76cf82bf5fc337c39cb11264bdf8bc8f09bc311b617103714e670367bc60ae2e842cf3c0bc14b3fca8fe5ff2b97826beaea59d3c02bc745b147b544d30b1dfd83dbb289ebed6a6995bdc5df6a6a719bd4cb8be4110513039613f685273104530412d8c6cd553728f85edb4ee2e85d4b1f69bdbd0732f8a91924c2211bdeb50efed4725365a05850abf52b58e26055a5c1b351baf96fabbd84c58dd053f81b4534e6a3d0073abcbcfc4423ec7b022bee4d68a9278ea42d3131956e150eedf067b180b1120b1bec7e21751bc0caf0e49bfe5e3b219c71ce62242af70258cc644c8c9bb1b542dacbba7101516fdba88bb464dcc0a7c305c8d1005f96d1448c934c1a296dc58f2e6a682f1db7dd40b1328951ede77cb30f1a28e0972a0e67fb93668575069234f2575d4a4e3676be7d8d322e46b2159bfef79d0167117f86b1fce016eb36f7f157cc1d3e8ab6eff964bf299f7d5a3a4e24abdad76b0933bd1c6cb9db845b9b9ae16cd9212bad14d114529a33b4c8dd889904e65ffb5906da62857b61653208eddddf151afe4cbff74ded8fb113a54033e56a2cd19650c24b7740757d555437bf0c90f82328435073682003d8a02afc5e77309e721424b2230a82f99158521c9bfd7d3bd7e12fcccfc693e6c7f4f3b1f9e7fd00ad89f0f11712232c8e51abf4be0e6e2578fae3c424c192d6adfbd222a612bfd8a1beb352bb4b59e48598f39707b4b77fc7ab09e0904b1ddc8b7c1a5534d98e706b8aee9eecfb45d841bfdd18616c0155e04f17e9d44e4381a1d161db0fa6b03d7f12818e57c9fe9893833348071d5e0a4c7cba1a02ae9bf11e4aa53c6f72393c5132667b443f3b979598a94f3782a1e4a5e891551349e45c559e9511b2ab1881bf916129dbdcf63add02f1d49fd3d8ce7644fb849e5dce6f66ba38f334b423905dcf421fcb154a706b649d902e9d4f00ea9775ba2cbd1315400939663cd210270b1aad6a8178bb2516b167f851969f29fd4e63069a8155a1624e165a4f94a7976099034baa85d591ba394858525237a9f5d8e1d3516db7e5e0e00ba56469cbf3eb06cb36bd3f07c6bc51ccda5d62cfbb1cc5ab2f55e63aa74c2fc0813c34e5e81536c018cd81b2cf5c3d8f25712158b0e6864bb88ed19643377ce0798a2fcf2580d7516fb5389bd01d5286a3b6da60213ed1825d36e27e6375542af64ed0ef5f6ae34efea795fab51a8b10346adadb695a090fa72d77c98d847c145c5e51aa827bd0f6f950a6b06ad15b31ca040a0863cff60820a7690f258190178dd29671da3687c482369a3de45b9cb2294a01d2621b13be3b838a3eeaedc59fecb5da78266bf4ca32d79976ee9a9ba4d448a9ab3152b92f7f7ed313eed9df8fef92557cfe2457553e6920fdb706955703382ea9c295ad59fa99971486a5607a7b3ebd7f093f469a2d4a92e2353a3518cab2f562ef1b2e563e9fdd43df67e74d2b528d0142d04077cf39d7e0cb009f4c5c7fb970bdca450290de60677ac350ee890c6f210539d77862cab1fd2595e3719f87f8554720649c7630480e49ccf0742cb675b202e0f2233da890c604fb68ec32ab0550b70b74c3df4ac472863135e1440ef94b46f448a7fca2734f0a4c619576c95fa78bd193b9cb489428513b33374070b447877651845fe9a502a2a8b4d81faa31a1bd56f0a1c730d18b5c2f01d8229b843e2494818f037bbf21d3829714d66e56be1d0efc49de7bbcf5cb8c30ad577f612a6bc3b4e30a5b750ef0f1cab32ec36b24f24320dbf39b378f63723f888cb85cbf0691d7cc2410e3077feb43f0a9198dbd69a0b501c7ea5da8223e739b549dc31c6d09c998d8b75a025990cfdf9ec2f2b7ff90334612518f79431a16f99bf02750d157ce90ac15b3f222b30ca841db441817de1baac9cf8196dd06a088d50853eb404eeb9b59b5370fcb9a98cbd28f8631cec78c217824e2371333bcea286791ee65eecb8c9160fd93cfc3c15a536566a932cc3f0036cd38b787872ddb1fa69885286222026e03e36446a4c2d6ee1bd0d68558f8aebb42670977f7d3ab26ef9a910ba1a5ef485d2b86a6e83f3543fc76ed982da428bd7a444ca65097f3732818d83aed05f699842c26c727befab16188c4f961cbd48a736a9b9080095786c534455a7a08a2118dd91ceb002468d38d8abeda1a501350af4ecef5458a2fa58391b4295d6be8d860614c42bee247e3fe48f46f27384817acca49dc3820bf72f33ff1dc56e571af324e4680d8721932ca9ae9e67eb0c82a442a3a97822e87e7fe5a4d585e7948f55cb2b7d0121e6b3bca6a42076ea42a3a37f81776b2e7c41d5f90c8010f3f5c5a5004ae37b27f186ae1d84eb9abf05c6af1c877571fb24a67c2876ce30945a2cae7cb5e4c6af9cc6218fbe0a68cff9933b7122d313619ef8c64cdd3b7777c36564b096c05dfe305562c40529c7f6484390dcfb1b8dcca84433d47bce2e0d5a0ca30ca4f9907e50dbdd2d0a3a9cda6d03e2dad7d62fa5fff6a66a8103b4be52bbe30750d4344592802b766f29c4b1bcfd3e219364becd9460357cbae535baa538f10d022508c5a619dfc42afc226a7496494562dd9726b3ac74528b3b7230a43a48cbaba3aa7ec4e82dd173234fc31d80de7c2b2b8bf61fed28e89a07bbd4bd5d90d4baa25db72d7a174bcc3ee0e5f40325304d5f544ae7308fee7d84bd1077ce2943a52a8469285860f178f58345552ade9c947c84eac1b099132aaa6873b9d721ee3ea2b63c8f325abdb9f4afeb30e724c7ea965edf3cfd5b5043c2e9227584e6ac6dec7ca01eb7e12959c9a4399f45a39831c9fc1c90c6de81aa640680bf5e537a09e7479361deaaae6798921e10b6e03e751d7c6e205b35658f806ccd015d42292f42125d14e1a3b3d2e6833f9a16e2639ec0417f080189d497193413a642cfe69c01f8b221c42794564dcf88367ced35c7673e880cd89b6d47c9dc81c41ce90bb1d55976c1d9b4f0a221583f895b70e274b3b43fe7213b72272ac3c9e4366e703aeb2dd27348c5c4d63bbccd19b8428db40efb00a185b3229e52159f638a1939f4693d88b927150f257ff841a1e29acde168bc8050479c500f3e63da60584fc304a203b68dee6a37b1828565065e19c587b6c59ebaff17ff934fdc446a86b24034fbb83582e9a40f80cabd3bc629047823d90af8e1f4a0fdb97abda9ff3455fe7bbcf1fda33ee4536d45131c476e7adaef8be27c39ddf7116ca82cec3acf33a6134bbd093451daf36fe84066503cde74fc42a3a145eb2e80ef4a6e5694fec77923ecce81d47ac58f0e6f1f8c57472fcb0219ce90f665a89362744b2984d979823f67e59f53da0595a7e4a44995a6e7b0d1d18b497d683445f456dfbafb6c52c1c6b8f946b012a7aaabebdc80c7126801d4f9a8c242b8c580ba0bf651f60ab544a2ccd4911a7149de2ec0bc9a25acdf7c178b8ff1252d79a04aa7b0ac7bfabe46718bd781788e291f735ef1816b4ed47afe909813a3a6d6f44f7d6742c29732d477e56df318c24ad43e7425d0579fb6ff9f9936af7602c811843ddb2509ef7ca9a2b832235152f619f33cc012c4ddd0ea7b0097c3be3c520efdd5b8dce3694cb97d95b861ae948bb1161c835dd35f872e3c721ae9f68fb22ec6590ac5fb46e93c5178e2c2593714784a9383fdac4897094310096f48a2fc7fe304efdeeaaab129b259ad306f9104103bf4926be07517fe9fabd605ea894f852604b1a5a6e7c016f2f42e902b212c172c878669c1ddcff1920828014849e74ec3d00f82d39708f403cdabda966a4d2bce89842cced3408cbbe144d179b5de91a7fb4270a70ea88151610251daea2e1bc192e739f7eced22fa25bbceb2b3f0404a3728e5b7c9bf0f562c631b6c697bad3ffc3a70fb0514f6d362e60f88dbf4d9265413895a60d9ab68dd21ffc68b11fd818c8f8d1794bd5e126f38927afda305585717206b14a0e58c7eb725b218641391834abf3b0d3ed47043346360b6842ef0f250fdd485afcc29f4b7add39a8f32e98394d0eeffcf0d155c71c4c70a34cde2f83d8331f23702b6451dacae2d0669b50621374d558590b594c5e70e66b270b858e0dd2b142b3b4a5ca50a67c58caf7d667b11e2756ccc59a6a5747b59a20b519ade2b688956e3de6099fc8c1dc8e5add35c66c9f3620b1dd26e92303f0dafa019a3190648657fe49170a8bb7f5b76765c34e8279ecf8a52dcaa7fba1f201262914dd2a64abea3ebf37c7bd16a5eac3c16b7e0082fdb93f90eeea5c421ea25b9265e308bb059c7c3b8040080c2aa1399e2ee393629ece126f8de572d402b6c9532290b77c5db2ed9f9e0b110940d265449d8826f3f8f9f7624825acc890cb380f8d60d466dd1a6b9de465d25ab9ac2a316c2b89d9b854f6550942da09bac1370b4b89ec05ba961b5478fc317bd2427faa30b025112eca2135e08cbe8f03c043f6dd314909a0ef3366e06647b9a17d89d4ba6b43cb24257ad55469b9a29e44308883c6668cbb1be454c790ebb8fc1ecaee5987a73ff829a03d7cfd2af788dbbfa8db247117b2d1464cb02de33444f39a43275839e2e47051bcaa76b31fb04718b37f1dbcfe7a5c28e817cd590d6265ca9f90b0fa0664c50bc13f4c4b5c8a9127c4b998b870123ef6194d97510115da8bf4d532d13cc3d05a918997dc65f54520eec538547deab3e42294aa9314b6bfcff8c7c10e854f8d55495c8a36510d4575d7d2f905c2e4ed5bbe93ffec438264cafbb79c1026b64b519afedcf291a84c116b6a01d196736fe1c97506ab8c2893daff041c0337db9bbd0fde9fab0cab27c8f11d3761702086920da73bae45d03cd977a2d0e11df6e7f467ad1672b0fb908caee398b49dc7e6c4c54f31a26295ccdc69d592b5627c8c71ab7013018e05db4d4dc68ca7cbb0248ef21847e0fa5e242b21bb4ff9c971bd2b92aa20134f5b50792850f90a7b9598151b0d51f30beaa71e7f649e4412cb40f6923f5f82f32e177e778246398f75a1ab1460070e28ebe46e5d8a2638ee91c31b1c03709a42dc0fdc252666965793c21a719b144ed21d5d", 0x1000, 0x5}, {&(0x7f0000000200)="90e1afca904b8616dde9e4d5f126ba6f8d4c8d111aa0db3bd106e156d27b027b247d49a9f0420be5def62fdebf5715c23386d2db07e91d32e1ea3f4efd64706586de6eaee8daae42f2e7fc8fbb9861eac83b5b1befa8ecde106c6679442b596917e9da3253043e10094b66d77737be386285d8cc80", 0x75, 0x1}, {&(0x7f0000000280)="6c726df1be3cce072a3b5d23cdd827f3c1976ff998e1eaa7a28ed3d184867efdec9ed595d1596e7fd6d7e3baa11b0953055899b9a5230bf9f2dab5cce424349494c42fa10f6e6a85c6f3914f1b2fa145ca2aff2eaf94be222b187f11f805d8ff2a8632b916df28128aff9704ab8d4a81fb3eeac0d710cc49e7a5df367653037e5f487bc7e47ec5e84e34ff1936102a00f9462c9d9e79f97d239eadebe07d7995d0f88a807b4e8cda5c762a6c6395c07a0f438d40713ecae1fbf157e671d2cc61affc1be61cc40f69b86dde6253d0b078a37a4e234aa9731842fd", 0xda, 0x200}, {&(0x7f0000000380)="ee3f1297e65141b63154e83e5f7e060f47c4d67dd91f9687a3da040202e89ded0a89fc84b5bf1219786d912cfaab03e5dcd387b2d4b3b664f1fdcddd43f7f9730bb6a8bf8953af3afb9976a4b65f5cbe5b27de01aa2d1ba81f9419bdd934234f81ad0cd1216ba2d546589307cc49318c1565d5bd9c2828895e2c840533fb2da78ca05a05d124b91d5b5f46cc65a6f536564708f86ff2855dbb30cd49997bc4b0a7eb6abaec5d36002faf9fa3fc89dbdd13dd008b16db5a1fa637b575c8450c126d9430b9580017cdc56a58ffc0cf606d2c2b8faf93e885620fdbc020e6b2fdd5515b8e413b7c3d", 0xe7, 0x3f}], 0x4, &(0x7f00000015c0)=ANY=[@ANYBLOB='integrity,measure,obj_type=/proc/sys/net/ipv4/vs/nat_icmp_send\x00,func=KEXEC_INITRAMFS_CHECK,smackfsroot=(+,fowner=', @ANYRESDEC=r5, @ANYBLOB]) socket$inet6_dccp(0xa, 0x6, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r8 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r8, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r8, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r8, r9, 0x0, 0xffffffff) ioctl$KVM_CREATE_PIT2(r9, 0x4040ae77, &(0x7f0000001680)={0x6}) sendfile(r6, r7, 0x0, 0xffffffff) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x6, 0x34756a4966020ddc, r7, 0xf68e5000) 01:29:16 executing program 2: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) io_setup(0x7, &(0x7f0000000100)=0x0) io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x3, 0x1, 0x0, r0, &(0x7f0000000000), 0x10000}]) 01:29:16 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000100"}) 01:29:16 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000800100"}) 01:29:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16, 0x5d}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000080)={0x6, &(0x7f0000000000)=[{0x2, 0x20, 0x1, 0xd1}, {0x0, 0x86, 0x81, 0x1}, {0x3, 0x8, 0x3}, {0x6, 0x8, 0x6, 0x3f}, {0x5, 0x0, 0x7e}, {0xbdb5, 0x44, 0x9, 0xda}]}) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr="d838ed6e052b6211218092bbe1933bfd"}]}, &(0x7f0000000180)=0x10) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) socket$unix(0x1, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000200)={r5, @in6={{0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000100)={r5, 0x2b}, 0x8) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r6, r7, 0x0, 0xffffffff) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x30) ftruncate(r6, 0x17d) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) 01:29:16 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) accept4$bt_l2cap(r0, 0x0, &(0x7f0000000000), 0x800) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v1={0x1000000, [{0x1, 0x7fffffff}]}, 0xc, 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x5, 0x80, 0x0, 0x0, 0x0, 0x7f, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x18}, 0x6, 0x3, 0xfffffffe, 0x9}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:16 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000200"}) 01:29:16 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000300"}) [ 1408.056926][ T9332] FAT-fs (loop4): bogus number of reserved sectors [ 1408.119001][ T9332] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1408.148180][ C1] net_ratelimit: 19 callbacks suppressed [ 1408.148188][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1408.148205][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1408.153924][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1408.159667][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:29:17 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(0xffffffffffffffff) [ 1408.450030][ T9406] attempt to access beyond end of device 01:29:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16, 0x5d}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000080)={0x6, &(0x7f0000000000)=[{0x2, 0x20, 0x1, 0xd1}, {0x0, 0x86, 0x81, 0x1}, {0x3, 0x8, 0x3}, {0x6, 0x8, 0x6, 0x3f}, {0x5, 0x0, 0x7e}, {0xbdb5, 0x44, 0x9, 0xda}]}) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr="d838ed6e052b6211218092bbe1933bfd"}]}, &(0x7f0000000180)=0x10) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) socket$unix(0x1, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000200)={r5, @in6={{0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000100)={r5, 0x2b}, 0x8) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r6, r7, 0x0, 0xffffffff) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x30) ftruncate(r6, 0x17d) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) [ 1408.537840][ T9406] loop2: rw=1, want=130, limit=128 [ 1408.613894][ T9406] attempt to access beyond end of device [ 1408.689970][ T9406] loop2: rw=1, want=131, limit=128 01:29:17 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x300000000000000, 0x4) 01:29:17 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000400"}) [ 1408.718188][ T9406] attempt to access beyond end of device [ 1408.730037][ T9455] jfs: Unrecognized mount option "measure" or missing value [ 1408.737701][ T9406] loop2: rw=1, want=132, limit=128 [ 1408.782798][ T9463] FAT-fs (loop4): bogus number of reserved sectors [ 1408.839582][ T9463] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1408.878475][ T9406] buffer_io_error: 32 callbacks suppressed [ 1408.878487][ T9406] Buffer I/O error on dev loop2, logical block 131, lost async page write [ 1408.924259][ T9406] attempt to access beyond end of device [ 1408.930252][ T9406] loop2: rw=1, want=133, limit=128 [ 1408.935569][ T9406] Buffer I/O error on dev loop2, logical block 132, lost async page write [ 1408.944471][ T9406] attempt to access beyond end of device [ 1408.950289][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1408.950345][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1408.950354][ T9406] loop2: rw=1, want=142, limit=128 [ 1408.950374][ T9406] Buffer I/O error on dev loop2, logical block 141, lost async page write [ 1408.950412][ T9406] attempt to access beyond end of device [ 1408.950423][ T9406] loop2: rw=1, want=143, limit=128 [ 1408.950436][ T9406] Buffer I/O error on dev loop2, logical block 142, lost async page write [ 1408.950463][ T9406] attempt to access beyond end of device [ 1409.028186][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1409.033999][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:29:17 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000500"}) 01:29:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16, 0x5d}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f0000000080)={0x6, &(0x7f0000000000)=[{0x2, 0x20, 0x1, 0xd1}, {0x0, 0x86, 0x81, 0x1}, {0x3, 0x8, 0x3}, {0x6, 0x8, 0x6, 0x3f}, {0x5, 0x0, 0x7e}, {0xbdb5, 0x44, 0x9, 0xda}]}) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr="d838ed6e052b6211218092bbe1933bfd"}]}, &(0x7f0000000180)=0x10) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) socket$unix(0x1, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000200)={r5, @in6={{0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x100) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000100)={r5, 0x2b}, 0x8) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r6, r7, 0x0, 0xffffffff) creat(&(0x7f00000000c0)='./file0/file0\x00', 0x30) ftruncate(r6, 0x17d) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) [ 1409.118218][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1409.124089][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:29:17 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x2, 0x200000) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr="d838ed6e052b6211218092bbe1933bfd"}]}, &(0x7f0000000180)=0x10) r2 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000200)={r3, @in6={{0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000040)={0x4, 0x2, 0x2, 0xfd01, r3}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={r4, 0xf16d}, &(0x7f0000000100)=0x8) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r5, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r6 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r5, r6, 0x0, 0xffffffff) setsockopt$inet_opts(r6, 0x0, 0x4, &(0x7f0000000300)="0dd85c5a9e22dab95721dafd51e7e580d867e4e0179d00a8e27752a5014a2d6d958b0858776cf27467c067782f1444ec6be5c2d14f882aaf2d91e2a7fe66ae5f517b6fa687bf8d7c914f08b26664c8c2a8b711881584388c674870420970c264b3c677dfbf0c16995e645d968b7f2de7ffa756a4638582cadde60973320badc14e4205a2f4cd187b4ca684076fc1cce0b5c551b872b58668377e2be6433780f27d4ad271856a9d8c0b3fc3d05e86c1bcb9511dd5f1a6c098a989dc96f711b8e09982f26b20f13d258b0705318e504adaf1ce", 0xd2) r7 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r7, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r7, 0x0, 0x0, 0x4) [ 1409.278203][ T9406] loop2: rw=1, want=144, limit=128 01:29:18 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000600"}) [ 1409.330144][ T9406] Buffer I/O error on dev loop2, logical block 143, lost async page write [ 1409.339989][ T9580] FAT-fs (loop4): bogus number of reserved sectors [ 1409.354340][ T9580] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1409.390564][ T9406] attempt to access beyond end of device 01:29:18 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(0xffffffffffffffff) [ 1409.479350][ T9406] loop2: rw=1, want=145, limit=128 [ 1409.484518][ T9406] Buffer I/O error on dev loop2, logical block 144, lost async page write [ 1409.503571][ T9406] attempt to access beyond end of device [ 1409.509343][ T9406] loop2: rw=1, want=3897, limit=128 [ 1409.552889][ T9406] attempt to access beyond end of device [ 1409.566345][ T9406] loop2: rw=1, want=5529, limit=128 [ 1409.608626][ T9341] attempt to access beyond end of device 01:29:18 executing program 2: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) 01:29:18 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)={0x14, 0x8, 0x400, 0xe340, 0x40, 0x1, 0x800, [], 0x0, 0xffffffffffffffff, 0x4, 0x2}, 0x3c) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000001780)={&(0x7f0000001700)='./bus\x00', r0}, 0x10) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b64732e666174000204010002000270fff8", 0xfffffea3}], 0x90000, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) fspick(r1, &(0x7f0000000040)='./bus\x00', 0x1) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) r3 = syz_open_dev$video4linux(&(0x7f00000000c0)='/dev/v4l-subdev#\x00', 0x0, 0x0) get_thread_area(&(0x7f00000017c0)={0x3ff, 0x1000, 0x4000, 0x1, 0x3, 0x1, 0x1}) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0x4020565a, &(0x7f00000002c0)={0x0, 0x0, "49c785b660618b0c88baa6e981cd000000000000000700000000000000000080"}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000500)={0x4, 0x0, 0xe0, 0xfd, 0x2, 0x2, 0x6}, 0xc) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r5, r5, 0x0) syz_mount_image$jfs(&(0x7f00000000c0)='jfs\x00', &(0x7f0000000100)='./bus\x00', 0x8, 0x5, &(0x7f0000000480)=[{&(0x7f00000001c0)="d37e06f3abb35070200ef075c68f", 0xe, 0x101}, {&(0x7f00000005c0)="89fcaab8027c2636025926bca09a1ab31cbf843a40161c708180fb5658df1210f1a17174c9e0fcef6889ff5d8e6c5e66abb60e4b876d76f9992bf8dc6d744362d0c9cbec17373c9fc802df7e9c0fd8f377cdcc4080de786b63a3325f203672b01a327c34c16f1965f909d5e169b883b2ad40e8a932ef4093d80d9e6544ac776956054f48b31b30a8a851aaa9e3d06052d670d64fa04be756f182102430342e91d529f2e74dad84ea65ecde4379157b83871a1df5645d5ffd41afb3dbbd856bce223c404c133950068801c6274b5d70455ff23551c19d819a8786645dab014c9d1d96a056f8d96f3ab591b40ba2fa7e87c439bd706ed54c6edeb202483faf900fb6cf67c51d949a1e4ced2095e0afb505c1cbafae3602fa2b8b809d1d1645c94b2fd6ac1c70e427fdd6310ed9a315d0cedf80c9d481ea5b97f394e01fd893a1e50513214c66a47dc2a31528e8926c44588d6ff6e2b518df8e378e7fcea30aea73736fd90ea6b09a5dbab8a5f5604273ffe7dce2142e687ad656473347f3534db99d71fd5716d6b9cd2269c671606e3771f0d0e40ce74db2004b6fb158d13416d660f1b1b6f5aaaa49be0790493f62f0e86f4a6006025ad0e60fba94a5b86eef31e5b9f23bb76e7fbec5e748ee3a4cebd47c72bde521c73357e00b800b6054ed95f2816013af7b52098227e9f53e34b9057881e27033f3dbc55446d7d76cf82bf5fc337c39cb11264bdf8bc8f09bc311b617103714e670367bc60ae2e842cf3c0bc14b3fca8fe5ff2b97826beaea59d3c02bc745b147b544d30b1dfd83dbb289ebed6a6995bdc5df6a6a719bd4cb8be4110513039613f685273104530412d8c6cd553728f85edb4ee2e85d4b1f69bdbd0732f8a91924c2211bdeb50efed4725365a05850abf52b58e26055a5c1b351baf96fabbd84c58dd053f81b4534e6a3d0073abcbcfc4423ec7b022bee4d68a9278ea42d3131956e150eedf067b180b1120b1bec7e21751bc0caf0e49bfe5e3b219c71ce62242af70258cc644c8c9bb1b542dacbba7101516fdba88bb464dcc0a7c305c8d1005f96d1448c934c1a296dc58f2e6a682f1db7dd40b1328951ede77cb30f1a28e0972a0e67fb93668575069234f2575d4a4e3676be7d8d322e46b2159bfef79d0167117f86b1fce016eb36f7f157cc1d3e8ab6eff964bf299f7d5a3a4e24abdad76b0933bd1c6cb9db845b9b9ae16cd9212bad14d114529a33b4c8dd889904e65ffb5906da62857b61653208eddddf151afe4cbff74ded8fb113a54033e56a2cd19650c24b7740757d555437bf0c90f82328435073682003d8a02afc5e77309e721424b2230a82f99158521c9bfd7d3bd7e12fcccfc693e6c7f4f3b1f9e7fd00ad89f0f11712232c8e51abf4be0e6e2578fae3c424c192d6adfbd222a612bfd8a1beb352bb4b59e48598f39707b4b77fc7ab09e0904b1ddc8b7c1a5534d98e706b8aee9eecfb45d841bfdd18616c0155e04f17e9d44e4381a1d161db0fa6b03d7f12818e57c9fe9893833348071d5e0a4c7cba1a02ae9bf11e4aa53c6f72393c5132667b443f3b979598a94f3782a1e4a5e891551349e45c559e9511b2ab1881bf916129dbdcf63add02f1d49fd3d8ce7644fb849e5dce6f66ba38f334b423905dcf421fcb154a706b649d902e9d4f00ea9775ba2cbd1315400939663cd210270b1aad6a8178bb2516b167f851969f29fd4e63069a8155a1624e165a4f94a7976099034baa85d591ba394858525237a9f5d8e1d3516db7e5e0e00ba56469cbf3eb06cb36bd3f07c6bc51ccda5d62cfbb1cc5ab2f55e63aa74c2fc0813c34e5e81536c018cd81b2cf5c3d8f25712158b0e6864bb88ed19643377ce0798a2fcf2580d7516fb5389bd01d5286a3b6da60213ed1825d36e27e6375542af64ed0ef5f6ae34efea795fab51a8b10346adadb695a090fa72d77c98d847c145c5e51aa827bd0f6f950a6b06ad15b31ca040a0863cff60820a7690f258190178dd29671da3687c482369a3de45b9cb2294a01d2621b13be3b838a3eeaedc59fecb5da78266bf4ca32d79976ee9a9ba4d448a9ab3152b92f7f7ed313eed9df8fef92557cfe2457553e6920fdb706955703382ea9c295ad59fa99971486a5607a7b3ebd7f093f469a2d4a92e2353a3518cab2f562ef1b2e563e9fdd43df67e74d2b528d0142d04077cf39d7e0cb009f4c5c7fb970bdca450290de60677ac350ee890c6f210539d77862cab1fd2595e3719f87f8554720649c7630480e49ccf0742cb675b202e0f2233da890c604fb68ec32ab0550b70b74c3df4ac472863135e1440ef94b46f448a7fca2734f0a4c619576c95fa78bd193b9cb489428513b33374070b447877651845fe9a502a2a8b4d81faa31a1bd56f0a1c730d18b5c2f01d8229b843e2494818f037bbf21d3829714d66e56be1d0efc49de7bbcf5cb8c30ad577f612a6bc3b4e30a5b750ef0f1cab32ec36b24f24320dbf39b378f63723f888cb85cbf0691d7cc2410e3077feb43f0a9198dbd69a0b501c7ea5da8223e739b549dc31c6d09c998d8b75a025990cfdf9ec2f2b7ff90334612518f79431a16f99bf02750d157ce90ac15b3f222b30ca841db441817de1baac9cf8196dd06a088d50853eb404eeb9b59b5370fcb9a98cbd28f8631cec78c217824e2371333bcea286791ee65eecb8c9160fd93cfc3c15a536566a932cc3f0036cd38b787872ddb1fa69885286222026e03e36446a4c2d6ee1bd0d68558f8aebb42670977f7d3ab26ef9a910ba1a5ef485d2b86a6e83f3543fc76ed982da428bd7a444ca65097f3732818d83aed05f699842c26c727befab16188c4f961cbd48a736a9b9080095786c534455a7a08a2118dd91ceb002468d38d8abeda1a501350af4ecef5458a2fa58391b4295d6be8d860614c42bee247e3fe48f46f27384817acca49dc3820bf72f33ff1dc56e571af324e4680d8721932ca9ae9e67eb0c82a442a3a97822e87e7fe5a4d585e7948f55cb2b7d0121e6b3bca6a42076ea42a3a37f81776b2e7c41d5f90c8010f3f5c5a5004ae37b27f186ae1d84eb9abf05c6af1c877571fb24a67c2876ce30945a2cae7cb5e4c6af9cc6218fbe0a68cff9933b7122d313619ef8c64cdd3b7777c36564b096c05dfe305562c40529c7f6484390dcfb1b8dcca84433d47bce2e0d5a0ca30ca4f9907e50dbdd2d0a3a9cda6d03e2dad7d62fa5fff6a66a8103b4be52bbe30750d4344592802b766f29c4b1bcfd3e219364becd9460357cbae535baa538f10d022508c5a619dfc42afc226a7496494562dd9726b3ac74528b3b7230a43a48cbaba3aa7ec4e82dd173234fc31d80de7c2b2b8bf61fed28e89a07bbd4bd5d90d4baa25db72d7a174bcc3ee0e5f40325304d5f544ae7308fee7d84bd1077ce2943a52a8469285860f178f58345552ade9c947c84eac1b099132aaa6873b9d721ee3ea2b63c8f325abdb9f4afeb30e724c7ea965edf3cfd5b5043c2e9227584e6ac6dec7ca01eb7e12959c9a4399f45a39831c9fc1c90c6de81aa640680bf5e537a09e7479361deaaae6798921e10b6e03e751d7c6e205b35658f806ccd015d42292f42125d14e1a3b3d2e6833f9a16e2639ec0417f080189d497193413a642cfe69c01f8b221c42794564dcf88367ced35c7673e880cd89b6d47c9dc81c41ce90bb1d55976c1d9b4f0a221583f895b70e274b3b43fe7213b72272ac3c9e4366e703aeb2dd27348c5c4d63bbccd19b8428db40efb00a185b3229e52159f638a1939f4693d88b927150f257ff841a1e29acde168bc8050479c500f3e63da60584fc304a203b68dee6a37b1828565065e19c587b6c59ebaff17ff934fdc446a86b24034fbb83582e9a40f80cabd3bc629047823d90af8e1f4a0fdb97abda9ff3455fe7bbcf1fda33ee4536d45131c476e7adaef8be27c39ddf7116ca82cec3acf33a6134bbd093451daf36fe84066503cde74fc42a3a145eb2e80ef4a6e5694fec77923ecce81d47ac58f0e6f1f8c57472fcb0219ce90f665a89362744b2984d979823f67e59f53da0595a7e4a44995a6e7b0d1d18b497d683445f456dfbafb6c52c1c6b8f946b012a7aaabebdc80c7126801d4f9a8c242b8c580ba0bf651f60ab544a2ccd4911a7149de2ec0bc9a25acdf7c178b8ff1252d79a04aa7b0ac7bfabe46718bd781788e291f735ef1816b4ed47afe909813a3a6d6f44f7d6742c29732d477e56df318c24ad43e7425d0579fb6ff9f9936af7602c811843ddb2509ef7ca9a2b832235152f619f33cc012c4ddd0ea7b0097c3be3c520efdd5b8dce3694cb97d95b861ae948bb1161c835dd35f872e3c721ae9f68fb22ec6590ac5fb46e93c5178e2c2593714784a9383fdac4897094310096f48a2fc7fe304efdeeaaab129b259ad306f9104103bf4926be07517fe9fabd605ea894f852604b1a5a6e7c016f2f42e902b212c172c878669c1ddcff1920828014849e74ec3d00f82d39708f403cdabda966a4d2bce89842cced3408cbbe144d179b5de91a7fb4270a70ea88151610251daea2e1bc192e739f7eced22fa25bbceb2b3f0404a3728e5b7c9bf0f562c631b6c697bad3ffc3a70fb0514f6d362e60f88dbf4d9265413895a60d9ab68dd21ffc68b11fd818c8f8d1794bd5e126f38927afda305585717206b14a0e58c7eb725b218641391834abf3b0d3ed47043346360b6842ef0f250fdd485afcc29f4b7add39a8f32e98394d0eeffcf0d155c71c4c70a34cde2f83d8331f23702b6451dacae2d0669b50621374d558590b594c5e70e66b270b858e0dd2b142b3b4a5ca50a67c58caf7d667b11e2756ccc59a6a5747b59a20b519ade2b688956e3de6099fc8c1dc8e5add35c66c9f3620b1dd26e92303f0dafa019a3190648657fe49170a8bb7f5b76765c34e8279ecf8a52dcaa7fba1f201262914dd2a64abea3ebf37c7bd16a5eac3c16b7e0082fdb93f90eeea5c421ea25b9265e308bb059c7c3b8040080c2aa1399e2ee393629ece126f8de572d402b6c9532290b77c5db2ed9f9e0b110940d265449d8826f3f8f9f7624825acc890cb380f8d60d466dd1a6b9de465d25ab9ac2a316c2b89d9b854f6550942da09bac1370b4b89ec05ba961b5478fc317bd2427faa30b025112eca2135e08cbe8f03c043f6dd314909a0ef3366e06647b9a17d89d4ba6b43cb24257ad55469b9a29e44308883c6668cbb1be454c790ebb8fc1ecaee5987a73ff829a03d7cfd2af788dbbfa8db247117b2d1464cb02de33444f39a43275839e2e47051bcaa76b31fb04718b37f1dbcfe7a5c28e817cd590d6265ca9f90b0fa0664c50bc13f4c4b5c8a9127c4b998b870123ef6194d97510115da8bf4d532d13cc3d05a918997dc65f54520eec538547deab3e42294aa9314b6bfcff8c7c10e854f8d55495c8a36510d4575d7d2f905c2e4ed5bbe93ffec438264cafbb79c1026b64b519afedcf291a84c116b6a01d196736fe1c97506ab8c2893daff041c0337db9bbd0fde9fab0cab27c8f11d3761702086920da73bae45d03cd977a2d0e11df6e7f467ad1672b0fb908caee398b49dc7e6c4c54f31a26295ccdc69d592b5627c8c71ab7013018e05db4d4dc68ca7cbb0248ef21847e0fa5e242b21bb4ff9c971bd2b92aa20134f5b50792850f90a7b9598151b0d51f30beaa71e7f649e4412cb40f6923f5f82f32e177e778246398f75a1ab1460070e28ebe46e5d8a2638ee91c31b1c03709a42dc0fdc252666965793c21a719b144ed21d5d", 0x1000, 0x5}, {&(0x7f0000000200)="90e1afca904b8616dde9e4d5f126ba6f8d4c8d111aa0db3bd106e156d27b027b247d49a9f0420be5def62fdebf5715c23386d2db07e91d32e1ea3f4efd64706586de6eaee8daae42f2e7fc8fbb9861eac83b5b1befa8ecde106c6679442b596917e9da3253043e10094b66d77737be386285d8cc80", 0x75, 0x1}, {&(0x7f0000000280)="6c726df1be3cce072a3b5d23cdd827f3c1976ff998e1eaa7a28ed3d184867efdec9ed595d1596e7fd6d7e3baa11b0953055899b9a5230bf9f2dab5cce424349494c42fa10f6e6a85c6f3914f1b2fa145ca2aff2eaf94be222b187f11f805d8ff2a8632b916df28128aff9704ab8d4a81fb3eeac0d710cc49e7a5df367653037e5f487bc7e47ec5e84e34ff1936102a00f9462c9d9e79f97d239eadebe07d7995d0f88a807b4e8cda5c762a6c6395c07a0f438d40713ecae1fbf157e671d2cc61affc1be61cc40f69b86dde6253d0b078a37a4e234aa9731842fd", 0xda, 0x200}, {&(0x7f0000000380)="ee3f1297e65141b63154e83e5f7e060f47c4d67dd91f9687a3da040202e89ded0a89fc84b5bf1219786d912cfaab03e5dcd387b2d4b3b664f1fdcddd43f7f9730bb6a8bf8953af3afb9976a4b65f5cbe5b27de01aa2d1ba81f9419bdd934234f81ad0cd1216ba2d546589307cc49318c1565d5bd9c2828895e2c840533fb2da78ca05a05d124b91d5b5f46cc65a6f536564708f86ff2855dbb30cd49997bc4b0a7eb6abaec5d36002faf9fa3fc89dbdd13dd008b16db5a1fa637b575c8450c126d9430b9580017cdc56a58ffc0cf606d2c2b8faf93e885620fdbc020e6b2fdd5515b8e413b7c3d", 0xe7, 0x3f}], 0x4, &(0x7f00000015c0)=ANY=[@ANYBLOB='integrity,measure,obj_type=/proc/sys/net/ipv4/vs/nat_icmp_send\x00,func=KEXEC_INITRAMFS_CHECK,smackfsroot=(+,fowner=', @ANYRESDEC=r5, @ANYBLOB]) socket$inet6_dccp(0xa, 0x6, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r8 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r8, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r8, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r8, r9, 0x0, 0xffffffff) ioctl$KVM_CREATE_PIT2(r9, 0x4040ae77, &(0x7f0000001680)={0x6}) sendfile(r6, r7, 0x0, 0xffffffff) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x6, 0x34756a4966020ddc, r7, 0xf68e5000) [ 1409.672993][ T9341] loop2: rw=2049, want=5633, limit=128 01:29:18 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:29:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x400000000000000, 0x4) 01:29:18 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) syz_mount_image$cifs(&(0x7f0000000000)='cifs\x00', &(0x7f0000000040)='./bus\x00', 0x4, 0x3, &(0x7f0000000400)=[{&(0x7f00000001c0)="985f601e794e54006613ca3ef55414fc631db6430132fcc820f49b6e7f299e730f6645f3aabd32e0caf12bb0deddad08b74d735d8afa519201bba2f1503176d75aca53370c192942560672e004e6d0bf1d73ca7afd805c3355cafc0bbd0844f13e5e02f5dd607a88172c3d956917dd43234908ad562b1ada1dd8616e5f3bc1cb266c3c805c419e5f362bc218d8f98f25a0b827f5ca3dc22bb1398d0ccb991f8da0dd3e287418f477a2ce089c687bca117222495b63c5e43446a3b49ae926ae025ea189e4f689deea59b65bf2e7a86217f7db874a20584ab1331fa2012ab8", 0xde, 0x6153}, {&(0x7f0000000080)="64f8b9608de4e0d7730938e844622edff0f20a19006f75a2ae6d2eb752fe3753b3732003dd2a481359edf2290dd3e539a7c33dc1d8c433d4abc5b2d6b7826295062d2a36da42b01c0d5058f84da9175dd0eba9394b886e516b53b0034c6928d08eef80543ed19c809ae14447828c5d3960", 0x71, 0x10000}, {&(0x7f0000000300)="b045f40db65d0c0c434b458ac396a1294956a73388617387dbb743d13464fe475a943cabf34202b8780c5fe4a44379113dca89af34eb3e843a84ca6df6e6073057090f292d11730bdc94f5484c1e83853c8f237845f31174905bf6f75b607ad4b0c02c878dec572cc91e21b2164bcfe39255b8ee92b1d1961bfefe41c17b557212c94e404a598ac40587ac83eac59763fde1c445b2767707ec86780831865b7a79fab52517f430a964bf9f68a7f4ce95b16538447c812524f98ba06a3688d6294c78eaca8d36567db4e481716dbdb041bcc38e971be588724d1b73ffceb8213fdfa942279be625e88fbb153342fa", 0xee, 0x6}], 0x80000, &(0x7f0000000100)='vboxnet1usersystem\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:18 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:29:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1410.311671][ T9830] attempt to access beyond end of device [ 1410.343249][ T9830] loop5: rw=1, want=130, limit=128 01:29:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1410.369206][ T9830] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1410.414634][ T9830] attempt to access beyond end of device 01:29:19 executing program 1: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) 01:29:19 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)={0x14, 0x8, 0x400, 0xe340, 0x40, 0x1, 0x800, [], 0x0, 0xffffffffffffffff, 0x4, 0x2}, 0x3c) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000001780)={&(0x7f0000001700)='./bus\x00', r0}, 0x10) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b64732e666174000204010002000270fff8", 0xfffffea3}], 0x90000, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) fspick(r1, &(0x7f0000000040)='./bus\x00', 0x1) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) r3 = syz_open_dev$video4linux(&(0x7f00000000c0)='/dev/v4l-subdev#\x00', 0x0, 0x0) get_thread_area(&(0x7f00000017c0)={0x3ff, 0x1000, 0x4000, 0x1, 0x3, 0x1, 0x1}) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0x4020565a, &(0x7f00000002c0)={0x0, 0x0, "49c785b660618b0c88baa6e981cd000000000000000700000000000000000080"}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000500)={0x4, 0x0, 0xe0, 0xfd, 0x2, 0x2, 0x6}, 0xc) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r5, r5, 0x0) syz_mount_image$jfs(&(0x7f00000000c0)='jfs\x00', &(0x7f0000000100)='./bus\x00', 0x8, 0x5, &(0x7f0000000480)=[{&(0x7f00000001c0)="d37e06f3abb35070200ef075c68f", 0xe, 0x101}, {&(0x7f00000005c0)="89fcaab8027c2636025926bca09a1ab31cbf843a40161c708180fb5658df1210f1a17174c9e0fcef6889ff5d8e6c5e66abb60e4b876d76f9992bf8dc6d744362d0c9cbec17373c9fc802df7e9c0fd8f377cdcc4080de786b63a3325f203672b01a327c34c16f1965f909d5e169b883b2ad40e8a932ef4093d80d9e6544ac776956054f48b31b30a8a851aaa9e3d06052d670d64fa04be756f182102430342e91d529f2e74dad84ea65ecde4379157b83871a1df5645d5ffd41afb3dbbd856bce223c404c133950068801c6274b5d70455ff23551c19d819a8786645dab014c9d1d96a056f8d96f3ab591b40ba2fa7e87c439bd706ed54c6edeb202483faf900fb6cf67c51d949a1e4ced2095e0afb505c1cbafae3602fa2b8b809d1d1645c94b2fd6ac1c70e427fdd6310ed9a315d0cedf80c9d481ea5b97f394e01fd893a1e50513214c66a47dc2a31528e8926c44588d6ff6e2b518df8e378e7fcea30aea73736fd90ea6b09a5dbab8a5f5604273ffe7dce2142e687ad656473347f3534db99d71fd5716d6b9cd2269c671606e3771f0d0e40ce74db2004b6fb158d13416d660f1b1b6f5aaaa49be0790493f62f0e86f4a6006025ad0e60fba94a5b86eef31e5b9f23bb76e7fbec5e748ee3a4cebd47c72bde521c73357e00b800b6054ed95f2816013af7b52098227e9f53e34b9057881e27033f3dbc55446d7d76cf82bf5fc337c39cb11264bdf8bc8f09bc311b617103714e670367bc60ae2e842cf3c0bc14b3fca8fe5ff2b97826beaea59d3c02bc745b147b544d30b1dfd83dbb289ebed6a6995bdc5df6a6a719bd4cb8be4110513039613f685273104530412d8c6cd553728f85edb4ee2e85d4b1f69bdbd0732f8a91924c2211bdeb50efed4725365a05850abf52b58e26055a5c1b351baf96fabbd84c58dd053f81b4534e6a3d0073abcbcfc4423ec7b022bee4d68a9278ea42d3131956e150eedf067b180b1120b1bec7e21751bc0caf0e49bfe5e3b219c71ce62242af70258cc644c8c9bb1b542dacbba7101516fdba88bb464dcc0a7c305c8d1005f96d1448c934c1a296dc58f2e6a682f1db7dd40b1328951ede77cb30f1a28e0972a0e67fb93668575069234f2575d4a4e3676be7d8d322e46b2159bfef79d0167117f86b1fce016eb36f7f157cc1d3e8ab6eff964bf299f7d5a3a4e24abdad76b0933bd1c6cb9db845b9b9ae16cd9212bad14d114529a33b4c8dd889904e65ffb5906da62857b61653208eddddf151afe4cbff74ded8fb113a54033e56a2cd19650c24b7740757d555437bf0c90f82328435073682003d8a02afc5e77309e721424b2230a82f99158521c9bfd7d3bd7e12fcccfc693e6c7f4f3b1f9e7fd00ad89f0f11712232c8e51abf4be0e6e2578fae3c424c192d6adfbd222a612bfd8a1beb352bb4b59e48598f39707b4b77fc7ab09e0904b1ddc8b7c1a5534d98e706b8aee9eecfb45d841bfdd18616c0155e04f17e9d44e4381a1d161db0fa6b03d7f12818e57c9fe9893833348071d5e0a4c7cba1a02ae9bf11e4aa53c6f72393c5132667b443f3b979598a94f3782a1e4a5e891551349e45c559e9511b2ab1881bf916129dbdcf63add02f1d49fd3d8ce7644fb849e5dce6f66ba38f334b423905dcf421fcb154a706b649d902e9d4f00ea9775ba2cbd1315400939663cd210270b1aad6a8178bb2516b167f851969f29fd4e63069a8155a1624e165a4f94a7976099034baa85d591ba394858525237a9f5d8e1d3516db7e5e0e00ba56469cbf3eb06cb36bd3f07c6bc51ccda5d62cfbb1cc5ab2f55e63aa74c2fc0813c34e5e81536c018cd81b2cf5c3d8f25712158b0e6864bb88ed19643377ce0798a2fcf2580d7516fb5389bd01d5286a3b6da60213ed1825d36e27e6375542af64ed0ef5f6ae34efea795fab51a8b10346adadb695a090fa72d77c98d847c145c5e51aa827bd0f6f950a6b06ad15b31ca040a0863cff60820a7690f258190178dd29671da3687c482369a3de45b9cb2294a01d2621b13be3b838a3eeaedc59fecb5da78266bf4ca32d79976ee9a9ba4d448a9ab3152b92f7f7ed313eed9df8fef92557cfe2457553e6920fdb706955703382ea9c295ad59fa99971486a5607a7b3ebd7f093f469a2d4a92e2353a3518cab2f562ef1b2e563e9fdd43df67e74d2b528d0142d04077cf39d7e0cb009f4c5c7fb970bdca450290de60677ac350ee890c6f210539d77862cab1fd2595e3719f87f8554720649c7630480e49ccf0742cb675b202e0f2233da890c604fb68ec32ab0550b70b74c3df4ac472863135e1440ef94b46f448a7fca2734f0a4c619576c95fa78bd193b9cb489428513b33374070b447877651845fe9a502a2a8b4d81faa31a1bd56f0a1c730d18b5c2f01d8229b843e2494818f037bbf21d3829714d66e56be1d0efc49de7bbcf5cb8c30ad577f612a6bc3b4e30a5b750ef0f1cab32ec36b24f24320dbf39b378f63723f888cb85cbf0691d7cc2410e3077feb43f0a9198dbd69a0b501c7ea5da8223e739b549dc31c6d09c998d8b75a025990cfdf9ec2f2b7ff90334612518f79431a16f99bf02750d157ce90ac15b3f222b30ca841db441817de1baac9cf8196dd06a088d50853eb404eeb9b59b5370fcb9a98cbd28f8631cec78c217824e2371333bcea286791ee65eecb8c9160fd93cfc3c15a536566a932cc3f0036cd38b787872ddb1fa69885286222026e03e36446a4c2d6ee1bd0d68558f8aebb42670977f7d3ab26ef9a910ba1a5ef485d2b86a6e83f3543fc76ed982da428bd7a444ca65097f3732818d83aed05f699842c26c727befab16188c4f961cbd48a736a9b9080095786c534455a7a08a2118dd91ceb002468d38d8abeda1a501350af4ecef5458a2fa58391b4295d6be8d860614c42bee247e3fe48f46f27384817acca49dc3820bf72f33ff1dc56e571af324e4680d8721932ca9ae9e67eb0c82a442a3a97822e87e7fe5a4d585e7948f55cb2b7d0121e6b3bca6a42076ea42a3a37f81776b2e7c41d5f90c8010f3f5c5a5004ae37b27f186ae1d84eb9abf05c6af1c877571fb24a67c2876ce30945a2cae7cb5e4c6af9cc6218fbe0a68cff9933b7122d313619ef8c64cdd3b7777c36564b096c05dfe305562c40529c7f6484390dcfb1b8dcca84433d47bce2e0d5a0ca30ca4f9907e50dbdd2d0a3a9cda6d03e2dad7d62fa5fff6a66a8103b4be52bbe30750d4344592802b766f29c4b1bcfd3e219364becd9460357cbae535baa538f10d022508c5a619dfc42afc226a7496494562dd9726b3ac74528b3b7230a43a48cbaba3aa7ec4e82dd173234fc31d80de7c2b2b8bf61fed28e89a07bbd4bd5d90d4baa25db72d7a174bcc3ee0e5f40325304d5f544ae7308fee7d84bd1077ce2943a52a8469285860f178f58345552ade9c947c84eac1b099132aaa6873b9d721ee3ea2b63c8f325abdb9f4afeb30e724c7ea965edf3cfd5b5043c2e9227584e6ac6dec7ca01eb7e12959c9a4399f45a39831c9fc1c90c6de81aa640680bf5e537a09e7479361deaaae6798921e10b6e03e751d7c6e205b35658f806ccd015d42292f42125d14e1a3b3d2e6833f9a16e2639ec0417f080189d497193413a642cfe69c01f8b221c42794564dcf88367ced35c7673e880cd89b6d47c9dc81c41ce90bb1d55976c1d9b4f0a221583f895b70e274b3b43fe7213b72272ac3c9e4366e703aeb2dd27348c5c4d63bbccd19b8428db40efb00a185b3229e52159f638a1939f4693d88b927150f257ff841a1e29acde168bc8050479c500f3e63da60584fc304a203b68dee6a37b1828565065e19c587b6c59ebaff17ff934fdc446a86b24034fbb83582e9a40f80cabd3bc629047823d90af8e1f4a0fdb97abda9ff3455fe7bbcf1fda33ee4536d45131c476e7adaef8be27c39ddf7116ca82cec3acf33a6134bbd093451daf36fe84066503cde74fc42a3a145eb2e80ef4a6e5694fec77923ecce81d47ac58f0e6f1f8c57472fcb0219ce90f665a89362744b2984d979823f67e59f53da0595a7e4a44995a6e7b0d1d18b497d683445f456dfbafb6c52c1c6b8f946b012a7aaabebdc80c7126801d4f9a8c242b8c580ba0bf651f60ab544a2ccd4911a7149de2ec0bc9a25acdf7c178b8ff1252d79a04aa7b0ac7bfabe46718bd781788e291f735ef1816b4ed47afe909813a3a6d6f44f7d6742c29732d477e56df318c24ad43e7425d0579fb6ff9f9936af7602c811843ddb2509ef7ca9a2b832235152f619f33cc012c4ddd0ea7b0097c3be3c520efdd5b8dce3694cb97d95b861ae948bb1161c835dd35f872e3c721ae9f68fb22ec6590ac5fb46e93c5178e2c2593714784a9383fdac4897094310096f48a2fc7fe304efdeeaaab129b259ad306f9104103bf4926be07517fe9fabd605ea894f852604b1a5a6e7c016f2f42e902b212c172c878669c1ddcff1920828014849e74ec3d00f82d39708f403cdabda966a4d2bce89842cced3408cbbe144d179b5de91a7fb4270a70ea88151610251daea2e1bc192e739f7eced22fa25bbceb2b3f0404a3728e5b7c9bf0f562c631b6c697bad3ffc3a70fb0514f6d362e60f88dbf4d9265413895a60d9ab68dd21ffc68b11fd818c8f8d1794bd5e126f38927afda305585717206b14a0e58c7eb725b218641391834abf3b0d3ed47043346360b6842ef0f250fdd485afcc29f4b7add39a8f32e98394d0eeffcf0d155c71c4c70a34cde2f83d8331f23702b6451dacae2d0669b50621374d558590b594c5e70e66b270b858e0dd2b142b3b4a5ca50a67c58caf7d667b11e2756ccc59a6a5747b59a20b519ade2b688956e3de6099fc8c1dc8e5add35c66c9f3620b1dd26e92303f0dafa019a3190648657fe49170a8bb7f5b76765c34e8279ecf8a52dcaa7fba1f201262914dd2a64abea3ebf37c7bd16a5eac3c16b7e0082fdb93f90eeea5c421ea25b9265e308bb059c7c3b8040080c2aa1399e2ee393629ece126f8de572d402b6c9532290b77c5db2ed9f9e0b110940d265449d8826f3f8f9f7624825acc890cb380f8d60d466dd1a6b9de465d25ab9ac2a316c2b89d9b854f6550942da09bac1370b4b89ec05ba961b5478fc317bd2427faa30b025112eca2135e08cbe8f03c043f6dd314909a0ef3366e06647b9a17d89d4ba6b43cb24257ad55469b9a29e44308883c6668cbb1be454c790ebb8fc1ecaee5987a73ff829a03d7cfd2af788dbbfa8db247117b2d1464cb02de33444f39a43275839e2e47051bcaa76b31fb04718b37f1dbcfe7a5c28e817cd590d6265ca9f90b0fa0664c50bc13f4c4b5c8a9127c4b998b870123ef6194d97510115da8bf4d532d13cc3d05a918997dc65f54520eec538547deab3e42294aa9314b6bfcff8c7c10e854f8d55495c8a36510d4575d7d2f905c2e4ed5bbe93ffec438264cafbb79c1026b64b519afedcf291a84c116b6a01d196736fe1c97506ab8c2893daff041c0337db9bbd0fde9fab0cab27c8f11d3761702086920da73bae45d03cd977a2d0e11df6e7f467ad1672b0fb908caee398b49dc7e6c4c54f31a26295ccdc69d592b5627c8c71ab7013018e05db4d4dc68ca7cbb0248ef21847e0fa5e242b21bb4ff9c971bd2b92aa20134f5b50792850f90a7b9598151b0d51f30beaa71e7f649e4412cb40f6923f5f82f32e177e778246398f75a1ab1460070e28ebe46e5d8a2638ee91c31b1c03709a42dc0fdc252666965793c21a719b144ed21d5d", 0x1000, 0x5}, {&(0x7f0000000200)="90e1afca904b8616dde9e4d5f126ba6f8d4c8d111aa0db3bd106e156d27b027b247d49a9f0420be5def62fdebf5715c23386d2db07e91d32e1ea3f4efd64706586de6eaee8daae42f2e7fc8fbb9861eac83b5b1befa8ecde106c6679442b596917e9da3253043e10094b66d77737be386285d8cc80", 0x75, 0x1}, {&(0x7f0000000280)="6c726df1be3cce072a3b5d23cdd827f3c1976ff998e1eaa7a28ed3d184867efdec9ed595d1596e7fd6d7e3baa11b0953055899b9a5230bf9f2dab5cce424349494c42fa10f6e6a85c6f3914f1b2fa145ca2aff2eaf94be222b187f11f805d8ff2a8632b916df28128aff9704ab8d4a81fb3eeac0d710cc49e7a5df367653037e5f487bc7e47ec5e84e34ff1936102a00f9462c9d9e79f97d239eadebe07d7995d0f88a807b4e8cda5c762a6c6395c07a0f438d40713ecae1fbf157e671d2cc61affc1be61cc40f69b86dde6253d0b078a37a4e234aa9731842fd", 0xda, 0x200}, {&(0x7f0000000380)="ee3f1297e65141b63154e83e5f7e060f47c4d67dd91f9687a3da040202e89ded0a89fc84b5bf1219786d912cfaab03e5dcd387b2d4b3b664f1fdcddd43f7f9730bb6a8bf8953af3afb9976a4b65f5cbe5b27de01aa2d1ba81f9419bdd934234f81ad0cd1216ba2d546589307cc49318c1565d5bd9c2828895e2c840533fb2da78ca05a05d124b91d5b5f46cc65a6f536564708f86ff2855dbb30cd49997bc4b0a7eb6abaec5d36002faf9fa3fc89dbdd13dd008b16db5a1fa637b575c8450c126d9430b9580017cdc56a58ffc0cf606d2c2b8faf93e885620fdbc020e6b2fdd5515b8e413b7c3d", 0xe7, 0x3f}], 0x4, &(0x7f00000015c0)=ANY=[@ANYBLOB='integrity,measure,obj_type=/proc/sys/net/ipv4/vs/nat_icmp_send\x00,func=KEXEC_INITRAMFS_CHECK,smackfsroot=(+,fowner=', @ANYRESDEC=r5, @ANYBLOB]) socket$inet6_dccp(0xa, 0x6, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r8 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r8, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r8, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r8, r9, 0x0, 0xffffffff) ioctl$KVM_CREATE_PIT2(r9, 0x4040ae77, &(0x7f0000001680)={0x6}) sendfile(r6, r7, 0x0, 0xffffffff) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x6, 0x34756a4966020ddc, r7, 0xf68e5000) [ 1410.560125][ T9834] attempt to access beyond end of device [ 1410.569165][ T9830] loop5: rw=1, want=131, limit=128 [ 1410.612298][ T9830] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1410.612342][ T9830] attempt to access beyond end of device [ 1410.627132][ T9834] loop0: rw=2049, want=130, limit=128 [ 1410.695049][ T9834] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1410.705105][ T9830] loop5: rw=1, want=132, limit=128 [ 1410.719087][ T9834] attempt to access beyond end of device 01:29:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) [ 1410.748234][ T9834] loop0: rw=2049, want=131, limit=128 [ 1410.758475][ T9830] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1410.775200][ T9834] attempt to access beyond end of device [ 1410.798818][ T9834] loop0: rw=2049, want=132, limit=128 [ 1410.848266][ T9834] attempt to access beyond end of device [ 1410.866621][ T9830] attempt to access beyond end of device [ 1410.876150][ T9834] loop0: rw=2049, want=133, limit=128 [ 1410.908473][ T9834] attempt to access beyond end of device [ 1410.935311][ T9834] loop0: rw=2049, want=142, limit=128 [ 1410.948006][ T9830] loop5: rw=1, want=133, limit=128 01:29:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000fffffdfd00"}) [ 1410.959243][ T9834] attempt to access beyond end of device [ 1411.008010][ T9834] loop0: rw=2049, want=143, limit=128 [ 1411.019172][ T9830] attempt to access beyond end of device [ 1411.046036][ T9834] attempt to access beyond end of device [ 1411.104375][ T9834] loop0: rw=2049, want=144, limit=128 [ 1411.124316][ T9830] loop5: rw=1, want=142, limit=128 [ 1411.129092][ T9834] attempt to access beyond end of device [ 1411.150485][ T9834] loop0: rw=2049, want=145, limit=128 [ 1411.176180][ T9834] attempt to access beyond end of device [ 1411.212469][ T9830] attempt to access beyond end of device 01:29:19 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:19 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)={0x14, 0x8, 0x400, 0xe340, 0x40, 0x1, 0x800, [], 0x0, 0xffffffffffffffff, 0x4, 0x2}, 0x3c) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000001780)={&(0x7f0000001700)='./bus\x00', r0}, 0x10) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b64732e666174000204010002000270fff8", 0xfffffea3}], 0x90000, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) fspick(r1, &(0x7f0000000040)='./bus\x00', 0x1) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) r3 = syz_open_dev$video4linux(&(0x7f00000000c0)='/dev/v4l-subdev#\x00', 0x0, 0x0) get_thread_area(&(0x7f00000017c0)={0x3ff, 0x1000, 0x4000, 0x1, 0x3, 0x1, 0x1}) ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0x4020565a, &(0x7f00000002c0)={0x0, 0x0, "49c785b660618b0c88baa6e981cd000000000000000700000000000000000080"}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000016c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000500)={0x4, 0x0, 0xe0, 0xfd, 0x2, 0x2, 0x6}, 0xc) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(r5, r5, 0x0) syz_mount_image$jfs(&(0x7f00000000c0)='jfs\x00', &(0x7f0000000100)='./bus\x00', 0x8, 0x5, &(0x7f0000000480)=[{&(0x7f00000001c0)="d37e06f3abb35070200ef075c68f", 0xe, 0x101}, {&(0x7f00000005c0)="89fcaab8027c2636025926bca09a1ab31cbf843a40161c708180fb5658df1210f1a17174c9e0fcef6889ff5d8e6c5e66abb60e4b876d76f9992bf8dc6d744362d0c9cbec17373c9fc802df7e9c0fd8f377cdcc4080de786b63a3325f203672b01a327c34c16f1965f909d5e169b883b2ad40e8a932ef4093d80d9e6544ac776956054f48b31b30a8a851aaa9e3d06052d670d64fa04be756f182102430342e91d529f2e74dad84ea65ecde4379157b83871a1df5645d5ffd41afb3dbbd856bce223c404c133950068801c6274b5d70455ff23551c19d819a8786645dab014c9d1d96a056f8d96f3ab591b40ba2fa7e87c439bd706ed54c6edeb202483faf900fb6cf67c51d949a1e4ced2095e0afb505c1cbafae3602fa2b8b809d1d1645c94b2fd6ac1c70e427fdd6310ed9a315d0cedf80c9d481ea5b97f394e01fd893a1e50513214c66a47dc2a31528e8926c44588d6ff6e2b518df8e378e7fcea30aea73736fd90ea6b09a5dbab8a5f5604273ffe7dce2142e687ad656473347f3534db99d71fd5716d6b9cd2269c671606e3771f0d0e40ce74db2004b6fb158d13416d660f1b1b6f5aaaa49be0790493f62f0e86f4a6006025ad0e60fba94a5b86eef31e5b9f23bb76e7fbec5e748ee3a4cebd47c72bde521c73357e00b800b6054ed95f2816013af7b52098227e9f53e34b9057881e27033f3dbc55446d7d76cf82bf5fc337c39cb11264bdf8bc8f09bc311b617103714e670367bc60ae2e842cf3c0bc14b3fca8fe5ff2b97826beaea59d3c02bc745b147b544d30b1dfd83dbb289ebed6a6995bdc5df6a6a719bd4cb8be4110513039613f685273104530412d8c6cd553728f85edb4ee2e85d4b1f69bdbd0732f8a91924c2211bdeb50efed4725365a05850abf52b58e26055a5c1b351baf96fabbd84c58dd053f81b4534e6a3d0073abcbcfc4423ec7b022bee4d68a9278ea42d3131956e150eedf067b180b1120b1bec7e21751bc0caf0e49bfe5e3b219c71ce62242af70258cc644c8c9bb1b542dacbba7101516fdba88bb464dcc0a7c305c8d1005f96d1448c934c1a296dc58f2e6a682f1db7dd40b1328951ede77cb30f1a28e0972a0e67fb93668575069234f2575d4a4e3676be7d8d322e46b2159bfef79d0167117f86b1fce016eb36f7f157cc1d3e8ab6eff964bf299f7d5a3a4e24abdad76b0933bd1c6cb9db845b9b9ae16cd9212bad14d114529a33b4c8dd889904e65ffb5906da62857b61653208eddddf151afe4cbff74ded8fb113a54033e56a2cd19650c24b7740757d555437bf0c90f82328435073682003d8a02afc5e77309e721424b2230a82f99158521c9bfd7d3bd7e12fcccfc693e6c7f4f3b1f9e7fd00ad89f0f11712232c8e51abf4be0e6e2578fae3c424c192d6adfbd222a612bfd8a1beb352bb4b59e48598f39707b4b77fc7ab09e0904b1ddc8b7c1a5534d98e706b8aee9eecfb45d841bfdd18616c0155e04f17e9d44e4381a1d161db0fa6b03d7f12818e57c9fe9893833348071d5e0a4c7cba1a02ae9bf11e4aa53c6f72393c5132667b443f3b979598a94f3782a1e4a5e891551349e45c559e9511b2ab1881bf916129dbdcf63add02f1d49fd3d8ce7644fb849e5dce6f66ba38f334b423905dcf421fcb154a706b649d902e9d4f00ea9775ba2cbd1315400939663cd210270b1aad6a8178bb2516b167f851969f29fd4e63069a8155a1624e165a4f94a7976099034baa85d591ba394858525237a9f5d8e1d3516db7e5e0e00ba56469cbf3eb06cb36bd3f07c6bc51ccda5d62cfbb1cc5ab2f55e63aa74c2fc0813c34e5e81536c018cd81b2cf5c3d8f25712158b0e6864bb88ed19643377ce0798a2fcf2580d7516fb5389bd01d5286a3b6da60213ed1825d36e27e6375542af64ed0ef5f6ae34efea795fab51a8b10346adadb695a090fa72d77c98d847c145c5e51aa827bd0f6f950a6b06ad15b31ca040a0863cff60820a7690f258190178dd29671da3687c482369a3de45b9cb2294a01d2621b13be3b838a3eeaedc59fecb5da78266bf4ca32d79976ee9a9ba4d448a9ab3152b92f7f7ed313eed9df8fef92557cfe2457553e6920fdb706955703382ea9c295ad59fa99971486a5607a7b3ebd7f093f469a2d4a92e2353a3518cab2f562ef1b2e563e9fdd43df67e74d2b528d0142d04077cf39d7e0cb009f4c5c7fb970bdca450290de60677ac350ee890c6f210539d77862cab1fd2595e3719f87f8554720649c7630480e49ccf0742cb675b202e0f2233da890c604fb68ec32ab0550b70b74c3df4ac472863135e1440ef94b46f448a7fca2734f0a4c619576c95fa78bd193b9cb489428513b33374070b447877651845fe9a502a2a8b4d81faa31a1bd56f0a1c730d18b5c2f01d8229b843e2494818f037bbf21d3829714d66e56be1d0efc49de7bbcf5cb8c30ad577f612a6bc3b4e30a5b750ef0f1cab32ec36b24f24320dbf39b378f63723f888cb85cbf0691d7cc2410e3077feb43f0a9198dbd69a0b501c7ea5da8223e739b549dc31c6d09c998d8b75a025990cfdf9ec2f2b7ff90334612518f79431a16f99bf02750d157ce90ac15b3f222b30ca841db441817de1baac9cf8196dd06a088d50853eb404eeb9b59b5370fcb9a98cbd28f8631cec78c217824e2371333bcea286791ee65eecb8c9160fd93cfc3c15a536566a932cc3f0036cd38b787872ddb1fa69885286222026e03e36446a4c2d6ee1bd0d68558f8aebb42670977f7d3ab26ef9a910ba1a5ef485d2b86a6e83f3543fc76ed982da428bd7a444ca65097f3732818d83aed05f699842c26c727befab16188c4f961cbd48a736a9b9080095786c534455a7a08a2118dd91ceb002468d38d8abeda1a501350af4ecef5458a2fa58391b4295d6be8d860614c42bee247e3fe48f46f27384817acca49dc3820bf72f33ff1dc56e571af324e4680d8721932ca9ae9e67eb0c82a442a3a97822e87e7fe5a4d585e7948f55cb2b7d0121e6b3bca6a42076ea42a3a37f81776b2e7c41d5f90c8010f3f5c5a5004ae37b27f186ae1d84eb9abf05c6af1c877571fb24a67c2876ce30945a2cae7cb5e4c6af9cc6218fbe0a68cff9933b7122d313619ef8c64cdd3b7777c36564b096c05dfe305562c40529c7f6484390dcfb1b8dcca84433d47bce2e0d5a0ca30ca4f9907e50dbdd2d0a3a9cda6d03e2dad7d62fa5fff6a66a8103b4be52bbe30750d4344592802b766f29c4b1bcfd3e219364becd9460357cbae535baa538f10d022508c5a619dfc42afc226a7496494562dd9726b3ac74528b3b7230a43a48cbaba3aa7ec4e82dd173234fc31d80de7c2b2b8bf61fed28e89a07bbd4bd5d90d4baa25db72d7a174bcc3ee0e5f40325304d5f544ae7308fee7d84bd1077ce2943a52a8469285860f178f58345552ade9c947c84eac1b099132aaa6873b9d721ee3ea2b63c8f325abdb9f4afeb30e724c7ea965edf3cfd5b5043c2e9227584e6ac6dec7ca01eb7e12959c9a4399f45a39831c9fc1c90c6de81aa640680bf5e537a09e7479361deaaae6798921e10b6e03e751d7c6e205b35658f806ccd015d42292f42125d14e1a3b3d2e6833f9a16e2639ec0417f080189d497193413a642cfe69c01f8b221c42794564dcf88367ced35c7673e880cd89b6d47c9dc81c41ce90bb1d55976c1d9b4f0a221583f895b70e274b3b43fe7213b72272ac3c9e4366e703aeb2dd27348c5c4d63bbccd19b8428db40efb00a185b3229e52159f638a1939f4693d88b927150f257ff841a1e29acde168bc8050479c500f3e63da60584fc304a203b68dee6a37b1828565065e19c587b6c59ebaff17ff934fdc446a86b24034fbb83582e9a40f80cabd3bc629047823d90af8e1f4a0fdb97abda9ff3455fe7bbcf1fda33ee4536d45131c476e7adaef8be27c39ddf7116ca82cec3acf33a6134bbd093451daf36fe84066503cde74fc42a3a145eb2e80ef4a6e5694fec77923ecce81d47ac58f0e6f1f8c57472fcb0219ce90f665a89362744b2984d979823f67e59f53da0595a7e4a44995a6e7b0d1d18b497d683445f456dfbafb6c52c1c6b8f946b012a7aaabebdc80c7126801d4f9a8c242b8c580ba0bf651f60ab544a2ccd4911a7149de2ec0bc9a25acdf7c178b8ff1252d79a04aa7b0ac7bfabe46718bd781788e291f735ef1816b4ed47afe909813a3a6d6f44f7d6742c29732d477e56df318c24ad43e7425d0579fb6ff9f9936af7602c811843ddb2509ef7ca9a2b832235152f619f33cc012c4ddd0ea7b0097c3be3c520efdd5b8dce3694cb97d95b861ae948bb1161c835dd35f872e3c721ae9f68fb22ec6590ac5fb46e93c5178e2c2593714784a9383fdac4897094310096f48a2fc7fe304efdeeaaab129b259ad306f9104103bf4926be07517fe9fabd605ea894f852604b1a5a6e7c016f2f42e902b212c172c878669c1ddcff1920828014849e74ec3d00f82d39708f403cdabda966a4d2bce89842cced3408cbbe144d179b5de91a7fb4270a70ea88151610251daea2e1bc192e739f7eced22fa25bbceb2b3f0404a3728e5b7c9bf0f562c631b6c697bad3ffc3a70fb0514f6d362e60f88dbf4d9265413895a60d9ab68dd21ffc68b11fd818c8f8d1794bd5e126f38927afda305585717206b14a0e58c7eb725b218641391834abf3b0d3ed47043346360b6842ef0f250fdd485afcc29f4b7add39a8f32e98394d0eeffcf0d155c71c4c70a34cde2f83d8331f23702b6451dacae2d0669b50621374d558590b594c5e70e66b270b858e0dd2b142b3b4a5ca50a67c58caf7d667b11e2756ccc59a6a5747b59a20b519ade2b688956e3de6099fc8c1dc8e5add35c66c9f3620b1dd26e92303f0dafa019a3190648657fe49170a8bb7f5b76765c34e8279ecf8a52dcaa7fba1f201262914dd2a64abea3ebf37c7bd16a5eac3c16b7e0082fdb93f90eeea5c421ea25b9265e308bb059c7c3b8040080c2aa1399e2ee393629ece126f8de572d402b6c9532290b77c5db2ed9f9e0b110940d265449d8826f3f8f9f7624825acc890cb380f8d60d466dd1a6b9de465d25ab9ac2a316c2b89d9b854f6550942da09bac1370b4b89ec05ba961b5478fc317bd2427faa30b025112eca2135e08cbe8f03c043f6dd314909a0ef3366e06647b9a17d89d4ba6b43cb24257ad55469b9a29e44308883c6668cbb1be454c790ebb8fc1ecaee5987a73ff829a03d7cfd2af788dbbfa8db247117b2d1464cb02de33444f39a43275839e2e47051bcaa76b31fb04718b37f1dbcfe7a5c28e817cd590d6265ca9f90b0fa0664c50bc13f4c4b5c8a9127c4b998b870123ef6194d97510115da8bf4d532d13cc3d05a918997dc65f54520eec538547deab3e42294aa9314b6bfcff8c7c10e854f8d55495c8a36510d4575d7d2f905c2e4ed5bbe93ffec438264cafbb79c1026b64b519afedcf291a84c116b6a01d196736fe1c97506ab8c2893daff041c0337db9bbd0fde9fab0cab27c8f11d3761702086920da73bae45d03cd977a2d0e11df6e7f467ad1672b0fb908caee398b49dc7e6c4c54f31a26295ccdc69d592b5627c8c71ab7013018e05db4d4dc68ca7cbb0248ef21847e0fa5e242b21bb4ff9c971bd2b92aa20134f5b50792850f90a7b9598151b0d51f30beaa71e7f649e4412cb40f6923f5f82f32e177e778246398f75a1ab1460070e28ebe46e5d8a2638ee91c31b1c03709a42dc0fdc252666965793c21a719b144ed21d5d", 0x1000, 0x5}, {&(0x7f0000000200)="90e1afca904b8616dde9e4d5f126ba6f8d4c8d111aa0db3bd106e156d27b027b247d49a9f0420be5def62fdebf5715c23386d2db07e91d32e1ea3f4efd64706586de6eaee8daae42f2e7fc8fbb9861eac83b5b1befa8ecde106c6679442b596917e9da3253043e10094b66d77737be386285d8cc80", 0x75, 0x1}, {&(0x7f0000000280)="6c726df1be3cce072a3b5d23cdd827f3c1976ff998e1eaa7a28ed3d184867efdec9ed595d1596e7fd6d7e3baa11b0953055899b9a5230bf9f2dab5cce424349494c42fa10f6e6a85c6f3914f1b2fa145ca2aff2eaf94be222b187f11f805d8ff2a8632b916df28128aff9704ab8d4a81fb3eeac0d710cc49e7a5df367653037e5f487bc7e47ec5e84e34ff1936102a00f9462c9d9e79f97d239eadebe07d7995d0f88a807b4e8cda5c762a6c6395c07a0f438d40713ecae1fbf157e671d2cc61affc1be61cc40f69b86dde6253d0b078a37a4e234aa9731842fd", 0xda, 0x200}, {&(0x7f0000000380)="ee3f1297e65141b63154e83e5f7e060f47c4d67dd91f9687a3da040202e89ded0a89fc84b5bf1219786d912cfaab03e5dcd387b2d4b3b664f1fdcddd43f7f9730bb6a8bf8953af3afb9976a4b65f5cbe5b27de01aa2d1ba81f9419bdd934234f81ad0cd1216ba2d546589307cc49318c1565d5bd9c2828895e2c840533fb2da78ca05a05d124b91d5b5f46cc65a6f536564708f86ff2855dbb30cd49997bc4b0a7eb6abaec5d36002faf9fa3fc89dbdd13dd008b16db5a1fa637b575c8450c126d9430b9580017cdc56a58ffc0cf606d2c2b8faf93e885620fdbc020e6b2fdd5515b8e413b7c3d", 0xe7, 0x3f}], 0x4, &(0x7f00000015c0)=ANY=[@ANYBLOB='integrity,measure,obj_type=/proc/sys/net/ipv4/vs/nat_icmp_send\x00,func=KEXEC_INITRAMFS_CHECK,smackfsroot=(+,fowner=', @ANYRESDEC=r5, @ANYBLOB]) socket$inet6_dccp(0xa, 0x6, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r8 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r8, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r8, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r8, r9, 0x0, 0xffffffff) ioctl$KVM_CREATE_PIT2(r9, 0x4040ae77, &(0x7f0000001680)={0x6}) sendfile(r6, r7, 0x0, 0xffffffff) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x6, 0x34756a4966020ddc, r7, 0xf68e5000) 01:29:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000ff00"}) [ 1411.222831][ T9834] loop0: rw=2049, want=297, limit=128 [ 1411.250322][ T9823] attempt to access beyond end of device [ 1411.307230][ T9823] loop5: rw=2049, want=2417, limit=128 [ 1411.361079][ T9830] loop5: rw=1, want=143, limit=128 [ 1411.366285][ T9830] attempt to access beyond end of device [ 1411.435220][ T9823] attempt to access beyond end of device [ 1411.480171][ T9830] loop5: rw=1, want=144, limit=128 [ 1411.502894][ T9823] loop5: rw=2049, want=3577, limit=128 [ 1411.553683][ T9830] attempt to access beyond end of device [ 1411.585605][ T9830] loop5: rw=1, want=145, limit=128 01:29:20 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x500000000000000, 0x4) 01:29:20 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) syz_mount_image$ocfs2(&(0x7f0000000000)='ocfs2\x00', &(0x7f0000000040)='./bus\x00', 0x1ff, 0x6, &(0x7f00000006c0)=[{&(0x7f00000001c0)="798c2365b9654b8982d85cd154e6ceadaee5f309a982373f6f96b11e57f3cb063b5d1f8820558a8a69b1812ed765427ff70d7ec9e5d9e687aa2078629c09ab8f7231a7dea738391ba469272bdbda06a5664dc68b05e0edd982874f3fd4f31824bd73e96e148e24e179a34a3d508b79f184e6968f9ea63a24c703c0d816d63ce7807e136f6850897a53d0b7dd3fdfea6bbba9cb938b6da2c7487db28b3a43229d32dc180ca1eeb7611110214aa5c39cfeadd958a76df160ff5d8887584027c20980de42d2db0053d641c25a28230b71078cd92f02902b8ad6f067064a850ff50f50569efa37680f30c2e9d2e2676780bb9a344161107a2fc44824421ca665", 0xfe}, {&(0x7f0000000080)="9ad5a67a348d20b09fe5cf65365db141d49df4d5885f1dbd0f9e3b9e6547477b1eb7d950dbf8a0e35005677cbf057c5a97648d5861c723e51ca08b0450c90e6f9c7d28d469ce09d0920d02f90d5f21786d9d19ecc4bc6787ce49a71fc5d2ebe985305394c51ac98427036241ad6e3981840ae9aafa544c7ab98a648fc32a85e7f358a74c3f50fb8e1b30f9f50f6f6660aceaf527817709c66cd6c2e772e9b43d84ed962c0f074429d5d46ec9f7170a", 0xaf, 0x401000000}, {&(0x7f0000000300), 0x0, 0x6}, {&(0x7f0000000340)="2597c085691d85d9388087cbc84be431da32bb3b54dd48236638353eefa2f9d37ea486186b82c98b763575502a9ba19f9807ec364bcd32f4b71217e926e381e8ec758ae006aa3e818adba7273e24677d52f6e659decf484b850ab7f4f272e583ce748808981dda5bf21c33f8a30e64e41a9893aa6e9322d6c10907b475016cf8f6f4d3474409e013c7990691bdb2c708c659bea7705791cf0b99265fc6c46d01ef7575bd18a336357c2e9b296f552229f5c705b21c0d958a626181cacec3c30ceebb6ad9d2b98ef9b097e358a8036c6e9e7920afdc59a71d8e61a0", 0xdb, 0x7}, {&(0x7f0000000440)="1d535d52106cd324897377caa2170675e66be4fb5c4d934758370ba52fc429d602c1737611d692dc1e017d858e14a32958989c3f5a6d5ab794f73319d45e84aaea997a34c8b4de0f03c8c95d44c01cfc571153af", 0x54}, {&(0x7f00000005c0)="195303b1a82836db0f6a30a1906abe561743814575fce3212e6d4702681d79023f783ebf14510e7de9414fd85e3aba851dfdbb74357ad28da712eaac49bb2e2f0c1e95a6046a7612d514dd71f64a68c4f03130401b36efeea9ae3347a1bcb7f86c4c9caf408d4bc820f6779e70cf831008990bf6c5fed5dad6b2d5701b94e371ea74da0345a2fd52ff5e9af1df208746295b289a461d32fcb7d62e84b5e8ac6717a0e99772e3efb9adebb420876efff52f153d953d18d9bae5205914f3ea5c5e6150d26b9a3a0035682260b0d5f5c6718d2939add4d1560dee2f9c3b219f49866579e7bcf069a8932a5b8a664fc6035d93", 0xf1, 0x5}], 0x1020000, &(0x7f00000004c0)='\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:20 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000fdfdffff00"}) 01:29:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$void(r0, 0xc0045878) lsetxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB="00fbc90402fec51092a22cd2fd57ebc8ae573097f71499c7f112cc928dcedda7e1e18168c4894ebaf13c00000000c3260f83be7d448bfb2c472e21a206862b1922f4eb94ef25613f058edb8bb7687e5f8ef4751651f27a341f3818d573dd5e53ef23da3d48fb3f92a0cf349699808f7c5ade1fb59d356c235d54a1d0917208959670396088171114c8a61b5f657c01b7ff9552e468d7c77c235c3047edccbadbcc1ab8f15653ee0d81dad3c1e43bb6ac0bd54bcfe2070f495c4e9cf6a6d469a49ed9aea5a02f7139b2821d068ae4602ef90d77e35f24be3fbd985ae94d8b3dd1a10ddab3f4cc732f1319940102726a90bdca428eae6f30ea71078147ef3915e0cc9a8cf0402578cd907104a38a2f56b90e70d7b8536a34764748a02f1e15450e1bf0c2b57db06f6812b45701dc7fed2fc7ad5c7086d0aa2ee841ec1d6ede196e4234aa5688f207c61a3d21bb50e96c85430bfd990adfb691fd4d153d3308f9a68f3a959e7f173245"], 0xc9, 0x3) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000380)={{0x1e, @multicast2, 0x4e20, 0x0, 'sed\x00', 0x32, 0x1, 0x68}, {@multicast2, 0x4e22, 0x2000, 0x8001, 0x80000001, 0x2}}, 0x44) 01:29:20 executing program 1: perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000380)=0x1a, 0x4) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x3ffe, 0x4) fcntl$setstatus(r0, 0x4, 0x4b800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) r1 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='io\x00\xa0\xdf\xfc\xf4\bHp\xc9D.\x14\x05\xb9\xb03\xed8\xff\xa4/(,\xe1\xbf/e\xc5)\xc1(\x95\x10\xaeL\x84{%\x8a\x00\xb5\xf4\xf6\xe7\x93u\xda\x97\xb1\x86\x90psz\x8f\xa1)8O\xac\xaf\xb8E\x15\b\xa1I\xe6\xbf\xb7@\xeam1\xb1\xc9\x9cv\xde\xf1\x81\v\x04\x1c\xec\x91EQW\xe7\x02\xd7\xeaRF\x80\xd1<\xa1\xe3I`.)\x02+g\xf5\x12JJ\x10\x17\xa8\xe4\x7fI\xa3\xaf\x1c\xb0\x0f\x91\x8a\x1c\xab\x80\xc4`\x862\x1d\xeb\xe9T\xf3\xbd\x10f\xb5BG\xb7\x89\x15\xd6\x0ex\x82\xf4\xc9@9\x16\xd8\xfa\x98\xbd\xad\\jW7\xb8\xed\xe9\x15!\xda\xccs|\x88l\x9b\x9f\xbd7s\xca\xceS/\xcd\xe3\xed\aOa\xd5\f#{6\xa2`H*\xc0\xf6\x8a\xe2\x84\x89\xf2&;/u\xb3Ffy\xbds\x96\x17\x8f:\xf1\xc7\x80\xc2\x8f\xa5\xb1\xb3\x95R\x89\xf1\xb0\x0eO\x83\x8f\x92\xa8\xaa7\xfcx\x92B\xd9\xd7\x01]\xbf\xa0\xd0x;s\x02f%\xe36%\xc4\xc3\x17\x0e\tv-\xdd\x11p\xd9\x1a\xa9\xf01ew\xb6\x90\x01\x89\x1b\xb8\n\x98A\x8d2}\xef\x81\'D\x90\x94\xaf&+\xbf\xb6W\xa2\xc1E3\xec\xfa\x98:\\\xae\xb1\xaa\xc3\x7ft\bdo\xa285\xa3\xdf\xf1\xb0\xde\xb3\xba\xd3\x01\x10\xb8x\xee\x80\xca\x9dp\x99fG\x1ak>\xa61\x94Ys\x1a;\xdbft\xb4Y\\\xa4\x0f\xfc\x9a\xfa><\x8fd\xa6\xce\xe4\xbf\xf6\xdc\xd40\xe3\xfb\xa9\xb1?\x9a\xff\xac\x96\x15\x06\x14\xaeX\xa5\n\xea\x1e\x8e~\x12\xac\x84x\x80\x97\xe1G') preadv(r2, &(0x7f0000000700), 0x31f, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f00000000c0)=0x2000, 0x4) ioctl$VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000000)={0x169, 0x1, 0x0, "caedab98efd018e413f597719449ef5a7c55171172bb8a0ce4096c1fe6e87ece"}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@dev, @in=@multicast1}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) [ 1411.873135][T10113] attempt to access beyond end of device [ 1411.879571][T10113] loop0: rw=1, want=130, limit=128 [ 1411.898505][T10113] attempt to access beyond end of device [ 1411.904408][T10113] loop0: rw=1, want=131, limit=128 [ 1411.926560][T10113] attempt to access beyond end of device [ 1411.968514][T10113] loop0: rw=1, want=132, limit=128 [ 1412.009445][T10113] attempt to access beyond end of device [ 1412.025064][T10113] loop0: rw=1, want=133, limit=128 [ 1412.038670][T10113] attempt to access beyond end of device [ 1412.068916][T10113] loop0: rw=1, want=142, limit=128 01:29:20 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000000100"}) [ 1412.110031][T10113] attempt to access beyond end of device [ 1412.141664][T10113] loop0: rw=1, want=143, limit=128 [ 1412.155663][T10113] attempt to access beyond end of device 01:29:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1412.221743][T10113] loop0: rw=1, want=144, limit=128 [ 1412.227406][T10113] attempt to access beyond end of device [ 1412.338383][T10113] loop0: rw=1, want=145, limit=128 01:29:21 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00@\x00'}) 01:29:21 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000800100"}) 01:29:21 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$void(r0, 0xc0045878) lsetxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB="00fbc90402fec51092a22cd2fd57ebc8ae573097f71499c7f112cc928dcedda7e1e18168c4894ebaf13c00000000c3260f83be7d448bfb2c472e21a206862b1922f4eb94ef25613f058edb8bb7687e5f8ef4751651f27a341f3818d573dd5e53ef23da3d48fb3f92a0cf349699808f7c5ade1fb59d356c235d54a1d0917208959670396088171114c8a61b5f657c01b7ff9552e468d7c77c235c3047edccbadbcc1ab8f15653ee0d81dad3c1e43bb6ac0bd54bcfe2070f495c4e9cf6a6d469a49ed9aea5a02f7139b2821d068ae4602ef90d77e35f24be3fbd985ae94d8b3dd1a10ddab3f4cc732f1319940102726a90bdca428eae6f30ea71078147ef3915e0cc9a8cf0402578cd907104a38a2f56b90e70d7b8536a34764748a02f1e15450e1bf0c2b57db06f6812b45701dc7fed2fc7ad5c7086d0aa2ee841ec1d6ede196e4234aa5688f207c61a3d21bb50e96c85430bfd990adfb691fd4d153d3308f9a68f3a959e7f173245"], 0xc9, 0x3) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000380)={{0x1e, @multicast2, 0x4e20, 0x0, 'sed\x00', 0x32, 0x1, 0x68}, {@multicast2, 0x4e22, 0x2000, 0x8001, 0x80000001, 0x2}}, 0x44) [ 1412.602446][T10113] attempt to access beyond end of device 01:29:21 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000000200"}) [ 1412.654923][T10113] loop0: rw=1, want=2497, limit=128 [ 1412.708533][T10113] attempt to access beyond end of device [ 1412.798975][T10108] attempt to access beyond end of device [ 1412.804774][T10113] loop0: rw=1, want=3713, limit=128 [ 1412.868439][T10108] loop0: rw=2049, want=3721, limit=128 01:29:21 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x600000000000000, 0x4) 01:29:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:21 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000000300"}) 01:29:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:21 executing program 4: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$void(r0, 0xc0045878) lsetxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB="00fbc90402fec51092a22cd2fd57ebc8ae573097f71499c7f112cc928dcedda7e1e18168c4894ebaf13c00000000c3260f83be7d448bfb2c472e21a206862b1922f4eb94ef25613f058edb8bb7687e5f8ef4751651f27a341f3818d573dd5e53ef23da3d48fb3f92a0cf349699808f7c5ade1fb59d356c235d54a1d0917208959670396088171114c8a61b5f657c01b7ff9552e468d7c77c235c3047edccbadbcc1ab8f15653ee0d81dad3c1e43bb6ac0bd54bcfe2070f495c4e9cf6a6d469a49ed9aea5a02f7139b2821d068ae4602ef90d77e35f24be3fbd985ae94d8b3dd1a10ddab3f4cc732f1319940102726a90bdca428eae6f30ea71078147ef3915e0cc9a8cf0402578cd907104a38a2f56b90e70d7b8536a34764748a02f1e15450e1bf0c2b57db06f6812b45701dc7fed2fc7ad5c7086d0aa2ee841ec1d6ede196e4234aa5688f207c61a3d21bb50e96c85430bfd990adfb691fd4d153d3308f9a68f3a959e7f173245"], 0xc9, 0x3) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000380)={{0x1e, @multicast2, 0x4e20, 0x0, 'sed\x00', 0x32, 0x1, 0x68}, {@multicast2, 0x4e22, 0x2000, 0x8001, 0x80000001, 0x2}}, 0x44) 01:29:21 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000000)={r0}) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r4, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r5}) r6 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r6, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r7 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r6, r7, 0x0, 0xffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f0000000040)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f00000001c0)=0xe8) pipe(&(0x7f0000000240)) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@empty, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4e22, 0xb46, 0x4e21, 0x3ff, 0x2, 0x0, 0x20, 0x73, r5, r8}, {0x9, 0x9, 0xfff, 0x8, 0x6, 0x20, 0x3, 0x401}, {0x80000000, 0x3, 0x100000001, 0x80000001}, 0x0, 0x6e6bb9, 0x4, 0x0, 0x472cf48b57f71b19}, {{@in6=@rand_addr="2dbd4697aa7bc4abca4821b6895ad3a8", 0x4d4, 0x16d}, 0x2, @in6=@rand_addr="556dee82088da3bddd2093a2d1abadcb", 0x3502, 0x0, 0x3, 0x5, 0x8, 0x6, 0xffffffff}}, 0xe8) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x9, 0x8000, 0x4) [ 1413.188191][ C0] net_ratelimit: 19 callbacks suppressed [ 1413.188200][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1413.199682][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1413.278882][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1413.285339][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1413.292278][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1413.298419][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:29:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000000400"}) 01:29:22 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000000500"}) 01:29:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1413.667199][T10500] attempt to access beyond end of device [ 1413.687591][T10500] loop5: rw=1, want=130, limit=128 [ 1413.693123][T10500] attempt to access beyond end of device [ 1413.707465][T10500] loop5: rw=1, want=131, limit=128 [ 1413.731995][T10500] attempt to access beyond end of device [ 1413.774147][T10500] loop5: rw=1, want=132, limit=128 [ 1413.816183][T10500] attempt to access beyond end of device [ 1413.852050][T10500] loop5: rw=1, want=133, limit=128 01:29:22 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1413.889145][T10500] buffer_io_error: 23 callbacks suppressed [ 1413.889158][T10500] Buffer I/O error on dev loop5, logical block 132, lost async page write 01:29:22 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r2}) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r4}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv4_delroute={0x4c, 0x19, 0x9e0c058ca55182b2, 0x70bd27, 0x25dfdbfb, {0x2, 0x0, 0x0, 0x3, 0x107, 0x0, 0x185, 0xe, 0x3500}, [@RTA_SRC={0x8, 0x2, @remote}, @RTA_PRIORITY={0x8, 0x6, 0x80}, @RTA_MULTIPATH={0xc, 0x9, {0x2, 0x1f, 0x7, r2}}, @RTA_MULTIPATH={0xc, 0x9, {0x1909, 0xff, 0x70, r4}}, @RTA_PREFSRC={0x8, 0x7, @broadcast}]}, 0x4c}}, 0x4000) [ 1413.965309][T10500] attempt to access beyond end of device [ 1414.008168][T10500] loop5: rw=1, want=142, limit=128 [ 1414.026593][T10500] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1414.051697][T10500] attempt to access beyond end of device [ 1414.071604][T10500] loop5: rw=1, want=143, limit=128 [ 1414.120345][T10500] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1414.226227][T10500] attempt to access beyond end of device [ 1414.264538][T10500] loop5: rw=1, want=144, limit=128 [ 1414.274463][T10500] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1414.335926][T10523] attempt to access beyond end of device [ 1414.342287][T10523] loop0: rw=1, want=130, limit=128 [ 1414.347921][T10523] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1414.354877][T10500] attempt to access beyond end of device [ 1414.362549][T10523] attempt to access beyond end of device [ 1414.371990][T10523] loop0: rw=1, want=131, limit=128 [ 1414.380845][T10523] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1414.388249][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1414.389650][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1414.395245][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1414.407142][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1414.413371][T10500] loop5: rw=1, want=145, limit=128 [ 1414.414814][T10523] attempt to access beyond end of device [ 1414.426340][T10523] loop0: rw=1, want=132, limit=128 [ 1414.432735][T10523] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1414.441982][T10523] attempt to access beyond end of device [ 1414.447727][T10523] loop0: rw=1, want=133, limit=128 [ 1414.453937][T10523] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1414.454546][T10448] attempt to access beyond end of device [ 1414.463551][T10523] attempt to access beyond end of device [ 1414.474399][T10523] loop0: rw=1, want=142, limit=128 [ 1414.480277][T10523] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1414.489342][T10523] attempt to access beyond end of device [ 1414.495177][T10523] loop0: rw=1, want=143, limit=128 [ 1414.501028][T10500] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1414.502019][T10523] attempt to access beyond end of device [ 1414.515601][T10523] loop0: rw=1, want=144, limit=128 [ 1414.522040][T10448] loop5: rw=2049, want=2289, limit=128 [ 1414.528461][T10523] attempt to access beyond end of device [ 1414.534257][T10523] loop0: rw=1, want=145, limit=128 [ 1414.542145][T10448] attempt to access beyond end of device [ 1414.547966][T10448] loop5: rw=2049, want=2305, limit=128 [ 1414.572429][T10448] attempt to access beyond end of device [ 1414.578364][T10448] loop5: rw=2049, want=4817, limit=128 [ 1414.585871][T10448] attempt to access beyond end of device [ 1414.585875][T10500] attempt to access beyond end of device [ 1414.585891][T10500] loop5: rw=1, want=2529, limit=128 [ 1414.591953][T10448] loop5: rw=2049, want=4905, limit=128 [ 1414.618992][T10523] attempt to access beyond end of device [ 1414.625007][T10523] loop0: rw=1, want=2305, limit=128 01:29:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x700000000000000, 0x4) 01:29:23 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000000600"}) 01:29:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:23 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:23 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) [ 1414.942179][T10523] attempt to access beyond end of device 01:29:23 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1414.993104][T10523] loop0: rw=1, want=4353, limit=128 [ 1415.013132][T10647] attempt to access beyond end of device [ 1415.029248][T10523] attempt to access beyond end of device [ 1415.035043][T10647] loop5: rw=1, want=130, limit=128 [ 1415.046995][T10523] loop0: rw=1, want=6601, limit=128 [ 1415.052704][T10647] attempt to access beyond end of device [ 1415.068182][T10647] loop5: rw=1, want=131, limit=128 [ 1415.074329][T10523] attempt to access beyond end of device [ 1415.102409][T10647] attempt to access beyond end of device [ 1415.127468][T10523] loop0: rw=1, want=7281, limit=128 [ 1415.144701][T10647] loop5: rw=1, want=132, limit=128 [ 1415.184116][T10519] attempt to access beyond end of device [ 1415.200137][T10647] attempt to access beyond end of device 01:29:24 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1415.230473][T10519] loop0: rw=2049, want=7745, limit=128 [ 1415.247058][T10647] loop5: rw=1, want=133, limit=128 [ 1415.291080][T10647] attempt to access beyond end of device [ 1415.358277][T10647] loop5: rw=1, want=142, limit=128 01:29:24 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1415.418021][T10647] attempt to access beyond end of device [ 1415.471640][T10647] loop5: rw=1, want=143, limit=128 [ 1415.568265][T10647] attempt to access beyond end of device [ 1415.574126][T10647] loop5: rw=1, want=144, limit=128 [ 1415.614617][T10647] attempt to access beyond end of device 01:29:24 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000002600)=[{&(0x7f0000000000)=""/229, 0xe5}, {&(0x7f00000005c0)=""/4096, 0x1000}, {&(0x7f0000000100)=""/45, 0x2d}, {&(0x7f00000001c0)=""/136, 0x88}, {&(0x7f0000000300)=""/70, 0x46}, {&(0x7f0000000380)=""/160, 0xa0}, {&(0x7f0000000440)=""/189, 0xbd}, {&(0x7f0000000280)=""/27, 0x1b}, {&(0x7f0000000500)=""/36, 0x24}], 0x9) fadvise64(r0, 0x0, 0x0, 0x4) [ 1415.831778][T10647] loop5: rw=1, want=145, limit=128 [ 1415.940919][T10622] attempt to access beyond end of device [ 1415.946604][T10622] loop5: rw=2049, want=2249, limit=128 [ 1416.007735][T10867] attempt to access beyond end of device [ 1416.013941][T10867] loop0: rw=1, want=130, limit=128 [ 1416.020101][T10867] attempt to access beyond end of device [ 1416.026155][T10867] loop0: rw=1, want=131, limit=128 [ 1416.032499][T10867] attempt to access beyond end of device [ 1416.040382][T10867] loop0: rw=1, want=132, limit=128 [ 1416.045935][T10867] attempt to access beyond end of device [ 1416.052358][T10867] loop0: rw=1, want=133, limit=128 [ 1416.058569][T10867] attempt to access beyond end of device [ 1416.064664][T10867] loop0: rw=1, want=142, limit=128 [ 1416.071450][T10867] attempt to access beyond end of device [ 1416.077489][T10867] loop0: rw=1, want=143, limit=128 [ 1416.083491][T10867] attempt to access beyond end of device [ 1416.090676][T10867] loop0: rw=1, want=144, limit=128 [ 1416.096260][T10867] attempt to access beyond end of device [ 1416.102600][T10867] loop0: rw=1, want=145, limit=128 [ 1416.110912][T10622] attempt to access beyond end of device [ 1416.158698][T10622] loop5: rw=2049, want=2617, limit=128 01:29:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x2000000000000000, 0x4) 01:29:25 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1416.211024][T10867] attempt to access beyond end of device [ 1416.232709][T10867] loop0: rw=1, want=2233, limit=128 01:29:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) 01:29:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1416.465243][T10867] attempt to access beyond end of device 01:29:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) 01:29:25 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1416.527569][T10867] loop0: rw=1, want=4313, limit=128 [ 1416.624638][T10916] attempt to access beyond end of device [ 1416.645827][T10916] loop5: rw=1, want=130, limit=128 01:29:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) [ 1416.713031][T10916] attempt to access beyond end of device [ 1416.719668][T10867] attempt to access beyond end of device [ 1416.725328][T10867] loop0: rw=1, want=5497, limit=128 [ 1416.778251][T10916] loop5: rw=1, want=131, limit=128 [ 1416.832484][T10916] attempt to access beyond end of device 01:29:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:25 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) [ 1416.901900][T10823] attempt to access beyond end of device [ 1416.907592][T10823] loop0: rw=2049, want=5889, limit=128 [ 1416.919928][T10916] loop5: rw=1, want=132, limit=128 [ 1416.957132][T10916] attempt to access beyond end of device 01:29:25 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1417.017832][T10916] loop5: rw=1, want=133, limit=128 [ 1417.058238][T10916] attempt to access beyond end of device [ 1417.108254][T10916] loop5: rw=1, want=142, limit=128 [ 1417.227555][T10916] attempt to access beyond end of device [ 1417.239272][T10916] loop5: rw=1, want=143, limit=128 01:29:26 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, r1) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x200, 0x0) ioctl$sock_SIOCOUTQ(r2, 0x5411, &(0x7f0000000080)) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, 0x0, 0xffffffff) read$dsp(r4, &(0x7f00000005c0)=""/4096, 0x1000) [ 1417.281252][T10916] attempt to access beyond end of device [ 1417.370641][T10916] loop5: rw=1, want=144, limit=128 [ 1417.401558][T10916] attempt to access beyond end of device [ 1417.410552][T10892] attempt to access beyond end of device [ 1417.416275][T10892] loop5: rw=2049, want=2217, limit=128 [ 1417.417474][T10916] loop5: rw=1, want=145, limit=128 [ 1417.431894][T10892] attempt to access beyond end of device [ 1417.437545][T10892] loop5: rw=2049, want=2889, limit=128 [ 1417.451516][T10892] attempt to access beyond end of device [ 1417.455737][T10916] attempt to access beyond end of device [ 1417.457334][T10892] loop5: rw=2049, want=4361, limit=128 [ 1417.494967][T10916] loop5: rw=1, want=3545, limit=128 01:29:26 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3a00000000000000, 0x4) 01:29:26 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:26 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000fffffdfd00"}) 01:29:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r1) 01:29:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1417.628880][T11038] attempt to access beyond end of device [ 1417.650967][T11038] loop0: rw=1, want=130, limit=128 [ 1417.681197][T11038] attempt to access beyond end of device [ 1417.688245][T11038] loop0: rw=1, want=131, limit=128 [ 1417.701045][T11038] attempt to access beyond end of device [ 1417.714727][T11038] loop0: rw=1, want=132, limit=128 [ 1417.730517][T11038] attempt to access beyond end of device 01:29:26 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000ff00"}) [ 1417.770496][T11038] loop0: rw=1, want=133, limit=128 01:29:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1417.822967][T11038] attempt to access beyond end of device [ 1417.832805][T11038] loop0: rw=1, want=142, limit=128 [ 1417.896304][T11038] attempt to access beyond end of device 01:29:26 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000ffffffff00"}) [ 1417.954663][T11126] attempt to access beyond end of device [ 1417.976842][T11038] loop0: rw=1, want=143, limit=128 [ 1417.987769][T11126] loop5: rw=1, want=130, limit=128 [ 1418.000472][T11038] attempt to access beyond end of device [ 1418.075558][T11126] attempt to access beyond end of device [ 1418.088744][T11038] loop0: rw=1, want=144, limit=128 [ 1418.123022][T11038] attempt to access beyond end of device [ 1418.136286][T11126] loop5: rw=1, want=131, limit=128 01:29:26 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000200"}) [ 1418.164186][T11038] loop0: rw=1, want=145, limit=128 [ 1418.178417][T11126] attempt to access beyond end of device 01:29:26 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) [ 1418.269705][T11126] loop5: rw=1, want=132, limit=128 01:29:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) [ 1418.378718][T11126] attempt to access beyond end of device [ 1418.391582][T11126] loop5: rw=1, want=133, limit=128 [ 1418.424971][T11126] attempt to access beyond end of device [ 1418.431074][T11126] loop5: rw=1, want=142, limit=128 [ 1418.436447][T11126] attempt to access beyond end of device [ 1418.440336][T11038] attempt to access beyond end of device [ 1418.475329][T11038] loop0: rw=1, want=2193, limit=128 [ 1418.488217][T11126] loop5: rw=1, want=143, limit=128 [ 1418.544643][T11126] attempt to access beyond end of device [ 1418.548176][ C1] net_ratelimit: 20 callbacks suppressed [ 1418.548183][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1418.550484][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1418.556005][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1418.561772][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1418.700312][T11038] attempt to access beyond end of device [ 1418.706037][T11038] loop0: rw=1, want=4241, limit=128 [ 1418.722579][T11126] loop5: rw=1, want=144, limit=128 [ 1418.734967][T11126] attempt to access beyond end of device [ 1418.745869][T11075] attempt to access beyond end of device [ 1418.751666][T11126] loop5: rw=1, want=145, limit=128 [ 1418.757051][T11075] loop5: rw=2049, want=2233, limit=128 [ 1418.766090][T11126] attempt to access beyond end of device [ 1418.772160][T11075] attempt to access beyond end of device [ 1418.777836][T11075] loop5: rw=2049, want=2241, limit=128 [ 1418.783979][T11126] loop5: rw=1, want=3121, limit=128 [ 1418.814521][T11031] attempt to access beyond end of device [ 1418.833929][T11038] attempt to access beyond end of device [ 1418.844075][T11031] loop0: rw=2049, want=5025, limit=128 [ 1418.846141][T11038] loop0: rw=1, want=4249, limit=128 01:29:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r1) 01:29:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000300"}) 01:29:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) 01:29:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) 01:29:27 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000000)) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:27 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3d00000000000000, 0x4) 01:29:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000400"}) 01:29:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) 01:29:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000500"}) [ 1419.140665][T11205] attempt to access beyond end of device 01:29:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) [ 1419.218240][T11205] loop5: rw=1, want=130, limit=128 [ 1419.223406][T11205] buffer_io_error: 43 callbacks suppressed [ 1419.223418][T11205] Buffer I/O error on dev loop5, logical block 129, lost async page write 01:29:28 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000600"}) [ 1419.323785][T11205] attempt to access beyond end of device [ 1419.348167][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1419.354030][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:29:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1419.428171][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1419.433995][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1419.435074][T11205] loop5: rw=1, want=131, limit=128 [ 1419.518200][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1419.518254][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1419.518637][T11205] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1419.628780][T11205] attempt to access beyond end of device [ 1419.660896][T11205] loop5: rw=1, want=132, limit=128 [ 1419.699617][T11205] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1419.724176][T11205] attempt to access beyond end of device [ 1419.750478][T11205] loop5: rw=1, want=133, limit=128 [ 1419.755829][T11205] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1419.764964][T11205] attempt to access beyond end of device [ 1419.785707][T11205] loop5: rw=1, want=142, limit=128 01:29:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r1) 01:29:28 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:29:28 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:28 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) connect$nfc_raw(r2, &(0x7f0000000000)={0x27, 0x0, 0x2, 0x4}, 0x10) 01:29:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1419.810775][T11205] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1419.859584][T11205] attempt to access beyond end of device [ 1419.922410][T11193] attempt to access beyond end of device [ 1419.925500][T11205] loop5: rw=1, want=143, limit=128 [ 1419.963762][T11205] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1420.047912][T11193] loop5: rw=2049, want=2201, limit=128 [ 1420.067888][T11205] attempt to access beyond end of device [ 1420.101208][T11351] attempt to access beyond end of device [ 1420.107106][T11351] loop0: rw=1, want=130, limit=128 [ 1420.118369][T11351] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1420.127333][T11351] attempt to access beyond end of device [ 1420.144636][T11193] attempt to access beyond end of device [ 1420.170502][T11351] loop0: rw=1, want=131, limit=128 [ 1420.181721][T11205] loop5: rw=1, want=144, limit=128 [ 1420.195745][T11205] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1420.231846][T11351] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1420.246302][T11193] loop5: rw=2049, want=4249, limit=128 [ 1420.256606][T11205] attempt to access beyond end of device [ 1420.278975][T11351] attempt to access beyond end of device [ 1420.286960][T11193] attempt to access beyond end of device [ 1420.299817][T11205] loop5: rw=1, want=145, limit=128 [ 1420.305613][T11351] loop0: rw=1, want=132, limit=128 [ 1420.315735][T11193] loop5: rw=2049, want=4433, limit=128 [ 1420.324737][T11351] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1420.339573][T11351] attempt to access beyond end of device [ 1420.354050][T11351] loop0: rw=1, want=133, limit=128 [ 1420.369346][T11351] attempt to access beyond end of device 01:29:29 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x3f00000000000000, 0x4) 01:29:29 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:29:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1420.382199][T11351] loop0: rw=1, want=142, limit=128 [ 1420.394456][T11351] attempt to access beyond end of device [ 1420.407470][T11351] loop0: rw=1, want=143, limit=128 [ 1420.444523][T11351] attempt to access beyond end of device [ 1420.492447][T11351] loop0: rw=1, want=144, limit=128 01:29:29 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:29:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1420.550016][T11351] attempt to access beyond end of device [ 1420.585073][T11351] loop0: rw=1, want=145, limit=128 01:29:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) close(0xffffffffffffffff) [ 1420.860862][T11351] attempt to access beyond end of device [ 1420.872548][T11351] loop0: rw=1, want=2193, limit=128 01:29:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) 01:29:29 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000800100"}) [ 1421.053994][T11351] attempt to access beyond end of device [ 1421.088663][T11351] loop0: rw=1, want=4201, limit=128 [ 1421.110901][T11241] attempt to access beyond end of device [ 1421.151959][T11241] loop0: rw=2049, want=6153, limit=128 [ 1421.190647][T11351] attempt to access beyond end of device [ 1421.214833][T11351] loop0: rw=1, want=6161, limit=128 [ 1421.227921][T11241] attempt to access beyond end of device [ 1421.240544][T11241] loop0: rw=2049, want=6169, limit=128 [ 1421.253584][T11351] attempt to access beyond end of device [ 1421.263338][T11351] loop0: rw=1, want=6177, limit=128 [ 1421.287593][T11241] attempt to access beyond end of device [ 1421.299069][T11241] loop0: rw=2049, want=6185, limit=128 [ 1421.311465][T11351] attempt to access beyond end of device [ 1421.326875][T11351] loop0: rw=1, want=6193, limit=128 [ 1421.332586][T11241] attempt to access beyond end of device [ 1421.338715][T11241] loop0: rw=2049, want=6201, limit=128 [ 1421.344449][T11351] attempt to access beyond end of device [ 1421.350545][T11351] loop0: rw=1, want=6209, limit=128 [ 1421.356012][T11241] attempt to access beyond end of device [ 1421.363130][T11241] loop0: rw=2049, want=6217, limit=128 [ 1421.369415][T11351] attempt to access beyond end of device [ 1421.375181][T11351] loop0: rw=1, want=6225, limit=128 [ 1421.380972][T11241] attempt to access beyond end of device [ 1421.386754][T11241] loop0: rw=2049, want=6233, limit=128 [ 1421.396529][T11351] attempt to access beyond end of device [ 1421.420636][T11351] loop0: rw=1, want=6241, limit=128 [ 1421.426176][T11241] attempt to access beyond end of device [ 1421.447071][T11241] loop0: rw=2049, want=6249, limit=128 [ 1421.463811][T11351] attempt to access beyond end of device [ 1421.470135][T11351] loop0: rw=1, want=6257, limit=128 [ 1421.476875][T11351] attempt to access beyond end of device [ 1421.480170][T11241] attempt to access beyond end of device [ 1421.495576][T11241] loop0: rw=2049, want=6265, limit=128 [ 1421.498210][T11351] loop0: rw=1, want=8017, limit=128 01:29:30 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e22, 0x2, @local, 0x4}, 0xffffffffffffff36) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) fadvise64(r0, 0x0, 0x0, 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, 0x0, 0xffffffff) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r4, 0xc0905664, &(0x7f0000000080)={0x0, 0x0, [], @bt={0x400, 0xfffffff2, 0x80000000, 0x5, 0x92e4, 0x7, 0x0, 0x8}}) 01:29:30 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) close(0xffffffffffffffff) 01:29:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000300"}) 01:29:30 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x4000000000000000, 0x4) 01:29:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) 01:29:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000500"}) 01:29:30 executing program 1: getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000600"}) 01:29:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:29:30 executing program 1: getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1422.352233][T11743] attempt to access beyond end of device [ 1422.364558][T11743] loop5: rw=1, want=130, limit=128 [ 1422.402474][T11743] attempt to access beyond end of device [ 1422.479025][T11743] loop5: rw=1, want=131, limit=128 [ 1422.484226][T11743] attempt to access beyond end of device [ 1422.594510][T11743] loop5: rw=1, want=132, limit=128 [ 1422.618343][T11743] attempt to access beyond end of device [ 1422.624046][T11743] loop5: rw=1, want=133, limit=128 [ 1422.639149][T11743] attempt to access beyond end of device [ 1422.676457][T11743] loop5: rw=1, want=142, limit=128 [ 1422.686883][T11743] attempt to access beyond end of device [ 1422.715896][T11743] loop5: rw=1, want=143, limit=128 [ 1422.722867][T11743] attempt to access beyond end of device [ 1422.734359][T11743] loop5: rw=1, want=144, limit=128 [ 1422.760643][T11743] attempt to access beyond end of device [ 1422.775371][T11743] loop5: rw=1, want=145, limit=128 [ 1422.835406][T11743] attempt to access beyond end of device [ 1422.864659][T11743] loop5: rw=1, want=2209, limit=128 [ 1422.888718][T11743] attempt to access beyond end of device [ 1422.901238][T11743] loop5: rw=1, want=5153, limit=128 [ 1422.930154][T11743] attempt to access beyond end of device [ 1422.968597][T11743] loop5: rw=1, want=7345, limit=128 [ 1423.002789][T11735] attempt to access beyond end of device [ 1423.008603][T11735] loop5: rw=2049, want=7985, limit=128 01:29:31 executing program 1: getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:31 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:29:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) close(r0) close(0xffffffffffffffff) 01:29:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) 01:29:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x4800000000000000, 0x4) 01:29:31 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000005c0)={{{@in6=@ipv4={[], [], @empty}, @in6=@empty}}, {{@in6=@ipv4={[], [], @empty}}}}, &(0x7f0000000480)=0xe8) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r2, 0x0, 0x0, 0x4) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x2300, 0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr="d838ed6e052b6211218092bbe1933bfd"}]}, &(0x7f0000000180)=0x10) r5 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000200)={r6, @in6={{0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x100) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000040)={r6, @in={{0x2, 0x4e23, @local}}}, &(0x7f0000000100)=0x84) ioctl$KVM_GET_CLOCK(r3, 0x8030ae7c, &(0x7f0000000300)) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f00000001c0)={r7, 0x9, 0x10, 0x4, 0xbbd1}, &(0x7f0000000200)=0x18) r8 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r8, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r8, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r9 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r8, r9, 0x0, 0xffffffff) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) write$evdev(r9, &(0x7f00000003c0)=[{{}, 0x1f, 0xc546, 0xe2d15001}, {{r10, r11/1000+10000}, 0x14, 0x1, 0x1}, {{0x0, 0x2710}, 0x2, 0x4e3d, 0x86ea}, {{r12, r13/1000+10000}, 0x17, 0x9, 0x401}, {{0x77359400}, 0xf080ba453735dc9b, 0xffff, 0x6}, {{0x77359400}, 0x7, 0x9, 0x81}], 0x90) 01:29:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:32 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:29:32 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:32 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000ff00"}) [ 1423.588251][ C0] net_ratelimit: 19 callbacks suppressed [ 1423.588260][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1423.599749][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:29:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1423.668186][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1423.674003][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1423.679859][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1423.685635][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:29:32 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000100"}) 01:29:32 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:32 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:33 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x4c00000000000000, 0x4) 01:29:33 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) ioctl$NBD_SET_TIMEOUT(r2, 0xab09, 0x40) 01:29:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000800100"}) 01:29:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1424.788159][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1424.788166][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1424.788210][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1424.793957][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1425.039721][T12137] attempt to access beyond end of device [ 1425.048224][T12137] loop5: rw=1, want=130, limit=128 01:29:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1425.106209][T12137] buffer_io_error: 14 callbacks suppressed [ 1425.106221][T12137] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1425.167758][T12139] attempt to access beyond end of device [ 1425.179376][T12137] attempt to access beyond end of device [ 1425.203423][T12137] loop5: rw=1, want=131, limit=128 01:29:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000200"}) [ 1425.221563][T12137] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1425.280031][T12139] loop0: rw=1, want=130, limit=128 [ 1425.296522][T12137] attempt to access beyond end of device [ 1425.330666][T12139] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1425.357611][T12137] loop5: rw=1, want=132, limit=128 [ 1425.385617][T12139] attempt to access beyond end of device [ 1425.406160][T12137] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1425.424292][T12139] loop0: rw=1, want=131, limit=128 01:29:34 executing program 4: accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1425.451977][T12139] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1425.488395][T12137] attempt to access beyond end of device 01:29:34 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000300"}) [ 1425.497643][T12139] attempt to access beyond end of device [ 1425.518290][T12137] loop5: rw=1, want=133, limit=128 [ 1425.526296][T12139] loop0: rw=1, want=132, limit=128 [ 1425.571830][T12139] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1425.591525][T12137] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1425.638737][T12139] attempt to access beyond end of device [ 1425.667110][T12137] attempt to access beyond end of device [ 1425.673502][T12139] loop0: rw=1, want=133, limit=128 [ 1425.701654][T12139] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1425.717072][T12137] loop5: rw=1, want=142, limit=128 [ 1425.738199][T12139] attempt to access beyond end of device [ 1425.749164][T12137] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1425.780521][T12139] loop0: rw=1, want=142, limit=128 [ 1425.837406][T12139] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1425.863563][T12080] attempt to access beyond end of device [ 1425.892358][T12139] attempt to access beyond end of device [ 1425.898300][T12137] attempt to access beyond end of device [ 1425.903941][T12137] loop5: rw=1, want=143, limit=128 [ 1425.903980][T12137] attempt to access beyond end of device [ 1425.916461][T12139] loop0: rw=1, want=143, limit=128 [ 1425.922335][T12139] attempt to access beyond end of device [ 1425.928022][T12080] loop5: rw=2049, want=2785, limit=128 [ 1425.936902][T12139] loop0: rw=1, want=144, limit=128 [ 1425.947666][T12080] attempt to access beyond end of device [ 1425.958830][T12133] attempt to access beyond end of device [ 1425.964593][T12139] attempt to access beyond end of device [ 1425.971117][T12137] loop5: rw=1, want=144, limit=128 [ 1425.976261][T12137] attempt to access beyond end of device [ 1425.977255][T12133] loop0: rw=2049, want=2489, limit=128 [ 1425.982338][T12139] loop0: rw=1, want=145, limit=128 [ 1425.993123][T12080] loop5: rw=2049, want=4833, limit=128 [ 1425.997514][T12133] attempt to access beyond end of device [ 1426.004622][T12133] loop0: rw=2049, want=4009, limit=128 [ 1426.008379][T12137] loop5: rw=1, want=145, limit=128 [ 1426.021254][T12137] attempt to access beyond end of device [ 1426.026910][T12137] loop5: rw=1, want=6889, limit=128 [ 1426.033942][T12080] attempt to access beyond end of device [ 1426.039694][T12080] loop5: rw=2049, want=4841, limit=128 [ 1426.048898][T12080] attempt to access beyond end of device [ 1426.060384][T12080] loop5: rw=2049, want=8961, limit=128 [ 1426.067458][T12137] attempt to access beyond end of device [ 1426.076425][T12137] loop5: rw=1, want=6897, limit=128 [ 1426.081963][T12080] attempt to access beyond end of device [ 1426.087717][T12080] loop5: rw=2049, want=8969, limit=128 [ 1426.093502][T12137] attempt to access beyond end of device [ 1426.099226][T12137] loop5: rw=1, want=8977, limit=128 [ 1426.104592][T12137] attempt to access beyond end of device [ 1426.110296][T12080] attempt to access beyond end of device [ 1426.115942][T12080] loop5: rw=2049, want=8985, limit=128 [ 1426.135097][T12137] loop5: rw=1, want=9169, limit=128 01:29:34 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x6000000000000000, 0x4) 01:29:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:34 executing program 4: accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:34 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000400"}) 01:29:34 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) ioctl$sock_x25_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000001c0)={@null=' \x00', 0xa, 'veth1_to_bond\x00'}) perf_event_open(&(0x7f0000000000)={0x1, 0xfffffffffffffe02, 0x0, 0x0, 0x0, 0x4, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x20}, 0x10, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:35 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000500"}) 01:29:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1426.418636][T12192] attempt to access beyond end of device [ 1426.423232][T12193] attempt to access beyond end of device [ 1426.438294][T12193] loop5: rw=1, want=130, limit=128 [ 1426.449215][T12193] attempt to access beyond end of device [ 1426.462901][T12193] loop5: rw=1, want=131, limit=128 [ 1426.474952][T12193] attempt to access beyond end of device [ 1426.481087][T12193] loop5: rw=1, want=132, limit=128 [ 1426.486406][T12193] attempt to access beyond end of device [ 1426.492558][T12193] loop5: rw=1, want=133, limit=128 [ 1426.497869][T12193] attempt to access beyond end of device [ 1426.504011][T12193] loop5: rw=1, want=142, limit=128 01:29:35 executing program 4: accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:35 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000600"}) [ 1426.521821][T12193] attempt to access beyond end of device [ 1426.523777][T12192] loop0: rw=1, want=130, limit=128 [ 1426.542212][T12193] loop5: rw=1, want=143, limit=128 [ 1426.612712][T12193] attempt to access beyond end of device [ 1426.627579][T12192] attempt to access beyond end of device [ 1426.646112][T12193] loop5: rw=1, want=144, limit=128 01:29:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1426.668557][T12193] attempt to access beyond end of device [ 1426.680567][T12192] loop0: rw=1, want=131, limit=128 [ 1426.693266][T12193] loop5: rw=1, want=145, limit=128 [ 1426.709725][T12192] attempt to access beyond end of device 01:29:35 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1426.745052][T12192] loop0: rw=1, want=132, limit=128 [ 1426.764289][T12193] attempt to access beyond end of device [ 1426.801695][T12192] attempt to access beyond end of device [ 1426.813910][T12193] loop5: rw=1, want=2193, limit=128 [ 1426.820718][T12192] loop0: rw=1, want=133, limit=128 [ 1426.853187][T12192] attempt to access beyond end of device [ 1426.886620][T12192] loop0: rw=1, want=142, limit=128 [ 1426.894405][T12193] attempt to access beyond end of device [ 1426.919885][T12192] attempt to access beyond end of device [ 1426.938024][T12193] loop5: rw=1, want=4273, limit=128 [ 1426.956873][T12192] loop0: rw=1, want=143, limit=128 [ 1426.974810][T12193] attempt to access beyond end of device [ 1426.989096][T12192] attempt to access beyond end of device [ 1426.997962][T12193] loop5: rw=1, want=5089, limit=128 [ 1427.023417][T12192] loop0: rw=1, want=144, limit=128 [ 1427.054866][T12192] attempt to access beyond end of device [ 1427.081728][T12192] loop0: rw=1, want=145, limit=128 [ 1427.113805][T12192] attempt to access beyond end of device [ 1427.127533][T12192] loop0: rw=1, want=2225, limit=128 [ 1427.142726][T12179] attempt to access beyond end of device [ 1427.154969][T12192] attempt to access beyond end of device [ 1427.165892][T12179] loop0: rw=2049, want=4121, limit=128 [ 1427.176333][T12192] loop0: rw=1, want=2233, limit=128 01:29:36 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x6800000000000000, 0x4) 01:29:36 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:29:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:36 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r0) 01:29:36 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000080)='./file0\x00', 0x1c1042, 0x8) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) getpeername$llc(r2, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000040)=0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1427.259590][T12189] attempt to access beyond end of device [ 1427.265404][T12189] loop5: rw=2049, want=7473, limit=128 [ 1427.275482][T12189] attempt to access beyond end of device [ 1427.281702][T12189] loop5: rw=2049, want=8073, limit=128 01:29:36 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:36 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:29:36 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:36 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1427.668586][T12237] attempt to access beyond end of device 01:29:36 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1427.751842][T12237] loop0: rw=1, want=130, limit=128 01:29:36 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1427.779580][T12237] attempt to access beyond end of device [ 1427.839469][T12237] loop0: rw=1, want=131, limit=128 [ 1427.896742][T12237] attempt to access beyond end of device [ 1427.976663][T12237] loop0: rw=1, want=132, limit=128 [ 1428.020075][T12237] attempt to access beyond end of device [ 1428.026021][T12237] loop0: rw=1, want=133, limit=128 [ 1428.031507][T12237] attempt to access beyond end of device [ 1428.037380][T12237] loop0: rw=1, want=142, limit=128 [ 1428.056068][T12237] attempt to access beyond end of device [ 1428.062567][T12237] loop0: rw=1, want=143, limit=128 [ 1428.067983][T12237] attempt to access beyond end of device [ 1428.074123][T12237] loop0: rw=1, want=144, limit=128 [ 1428.079595][T12237] attempt to access beyond end of device [ 1428.095141][T12237] loop0: rw=1, want=145, limit=128 [ 1428.106457][T12237] attempt to access beyond end of device [ 1428.113339][T12237] loop0: rw=1, want=2209, limit=128 [ 1428.124975][T12237] attempt to access beyond end of device [ 1428.131408][T12237] loop0: rw=1, want=4353, limit=128 [ 1428.139976][T12237] attempt to access beyond end of device [ 1428.145842][T12237] loop0: rw=1, want=4497, limit=128 [ 1428.303953][T12233] attempt to access beyond end of device [ 1428.314956][T12233] loop0: rw=2049, want=6489, limit=128 01:29:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x6c00000000000000, 0x4) 01:29:37 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:29:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r0) 01:29:37 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x1, 0x4) 01:29:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:29:37 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:37 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000fffffdfd00"}) 01:29:37 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x10200) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000ff00"}) [ 1428.948172][ C1] net_ratelimit: 20 callbacks suppressed [ 1428.948181][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1428.948205][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1428.953883][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1429.147964][T12311] attempt to access beyond end of device [ 1429.171449][T12311] loop0: rw=1, want=130, limit=128 [ 1429.179204][T12311] attempt to access beyond end of device [ 1429.185118][T12311] loop0: rw=1, want=131, limit=128 [ 1429.268770][T12311] attempt to access beyond end of device [ 1429.281634][T12311] loop0: rw=1, want=132, limit=128 [ 1429.293406][T12311] attempt to access beyond end of device [ 1429.306545][T12311] loop0: rw=1, want=133, limit=128 [ 1429.360922][T12311] attempt to access beyond end of device [ 1429.366768][T12311] loop0: rw=1, want=142, limit=128 [ 1429.414940][T12317] attempt to access beyond end of device [ 1429.421238][T12311] attempt to access beyond end of device [ 1429.427262][T12317] loop5: rw=1, want=130, limit=128 [ 1429.446969][T12311] loop0: rw=1, want=143, limit=128 [ 1429.459917][T12317] attempt to access beyond end of device [ 1429.465574][T12317] loop5: rw=1, want=131, limit=128 [ 1429.492510][T12311] attempt to access beyond end of device [ 1429.500362][T12317] attempt to access beyond end of device [ 1429.518247][T12311] loop0: rw=1, want=144, limit=128 [ 1429.526313][T12311] attempt to access beyond end of device [ 1429.532575][T12317] loop5: rw=1, want=132, limit=128 [ 1429.537741][T12317] attempt to access beyond end of device [ 1429.558173][T12317] loop5: rw=1, want=133, limit=128 [ 1429.563357][T12317] attempt to access beyond end of device [ 1429.580441][T12311] loop0: rw=1, want=145, limit=128 [ 1429.629036][T12317] loop5: rw=1, want=142, limit=128 [ 1429.640194][T12317] attempt to access beyond end of device [ 1429.652838][T12317] loop5: rw=1, want=143, limit=128 [ 1429.664749][T12317] attempt to access beyond end of device [ 1429.678806][T12317] loop5: rw=1, want=144, limit=128 [ 1429.689935][T12317] attempt to access beyond end of device [ 1429.691789][T12311] attempt to access beyond end of device [ 1429.707931][T12311] loop0: rw=1, want=3329, limit=128 [ 1429.708236][T12317] loop5: rw=1, want=145, limit=128 [ 1429.748200][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1429.754053][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1429.770847][T12317] attempt to access beyond end of device [ 1429.782508][T12317] loop5: rw=1, want=3097, limit=128 [ 1429.803889][T12311] attempt to access beyond end of device [ 1429.805631][T12317] attempt to access beyond end of device [ 1429.824540][T12311] loop0: rw=1, want=5377, limit=128 [ 1429.824782][T12317] loop5: rw=1, want=6497, limit=128 [ 1429.838521][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1429.844527][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1429.850201][T12317] attempt to access beyond end of device [ 1429.866352][T12317] loop5: rw=1, want=9145, limit=128 [ 1429.871124][T12311] attempt to access beyond end of device [ 1429.877239][T12311] loop0: rw=1, want=7425, limit=128 [ 1429.908220][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1429.914024][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1429.919901][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1429.955121][T12311] attempt to access beyond end of device [ 1429.962046][T12311] loop0: rw=1, want=8649, limit=128 [ 1429.975036][T12304] attempt to access beyond end of device [ 1429.983143][T12304] loop0: rw=2049, want=8993, limit=128 [ 1429.996028][T12311] attempt to access beyond end of device [ 1430.001874][T12311] loop0: rw=1, want=9193, limit=128 [ 1430.007473][T12304] attempt to access beyond end of device [ 1430.020170][T12304] loop0: rw=2049, want=9201, limit=128 [ 1430.034206][T12311] attempt to access beyond end of device [ 1430.042127][T12311] loop0: rw=1, want=9209, limit=128 [ 1430.047832][T12304] attempt to access beyond end of device [ 1430.078254][T12304] loop0: rw=2049, want=9217, limit=128 [ 1430.084040][T12311] attempt to access beyond end of device [ 1430.094674][T12311] loop0: rw=1, want=9313, limit=128 [ 1430.109111][T12304] attempt to access beyond end of device [ 1430.114778][T12304] loop0: rw=2049, want=9369, limit=128 [ 1430.121671][T12311] attempt to access beyond end of device [ 1430.128605][T12311] loop0: rw=1, want=9889, limit=128 [ 1430.134319][T12304] attempt to access beyond end of device [ 1430.139882][T12314] attempt to access beyond end of device [ 1430.140583][T12304] loop0: rw=2049, want=9985, limit=128 [ 1430.145650][T12314] loop5: rw=2049, want=13609, limit=128 [ 1430.151672][T12311] attempt to access beyond end of device [ 1430.163897][T12311] loop0: rw=1, want=9993, limit=128 [ 1430.166884][T12314] attempt to access beyond end of device 01:29:38 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x7400000000000000, 0x4) 01:29:38 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:38 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:38 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000fdfdffff00"}) 01:29:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) close(r0) [ 1430.169578][T12304] attempt to access beyond end of device [ 1430.175728][T12314] loop5: rw=2049, want=13761, limit=128 [ 1430.186169][T12304] loop0: rw=2049, want=10001, limit=128 [ 1430.192000][T12311] attempt to access beyond end of device [ 1430.197703][T12311] loop0: rw=1, want=10009, limit=128 [ 1430.208895][T12304] attempt to access beyond end of device [ 1430.214549][T12304] loop0: rw=2049, want=10017, limit=128 [ 1430.272347][T12311] attempt to access beyond end of device [ 1430.290279][T12311] loop0: rw=1, want=10025, limit=128 01:29:39 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000000100"}) 01:29:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1430.316661][T12304] attempt to access beyond end of device 01:29:39 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1430.374833][T12304] loop0: rw=2049, want=10105, limit=128 [ 1430.407628][T12311] attempt to access beyond end of device [ 1430.415838][T12311] loop0: rw=1, want=10145, limit=128 01:29:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1430.458268][T12304] attempt to access beyond end of device [ 1430.463947][T12304] loop0: rw=2049, want=10705, limit=128 [ 1430.512107][T12311] attempt to access beyond end of device [ 1430.531035][T12311] loop0: rw=1, want=10713, limit=128 [ 1430.607883][T12304] attempt to access beyond end of device [ 1430.643514][T12304] loop0: rw=2049, want=10721, limit=128 01:29:39 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000800100"}) [ 1430.671859][T12311] attempt to access beyond end of device [ 1430.678661][T12311] loop0: rw=1, want=10729, limit=128 [ 1430.687103][T12311] attempt to access beyond end of device [ 1430.691058][T12354] attempt to access beyond end of device [ 1430.717561][T12354] loop5: rw=1, want=130, limit=128 [ 1430.735695][T12354] buffer_io_error: 46 callbacks suppressed [ 1430.735708][T12354] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1430.779934][T12354] attempt to access beyond end of device [ 1430.792813][T12354] loop5: rw=1, want=131, limit=128 [ 1430.805010][T12354] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1430.813867][T12311] loop0: rw=1, want=12849, limit=128 [ 1430.827142][T12304] attempt to access beyond end of device [ 1430.848222][T12354] attempt to access beyond end of device [ 1430.853902][T12354] loop5: rw=1, want=132, limit=128 [ 1430.865195][T12304] loop0: rw=2049, want=10737, limit=128 [ 1430.902567][T12354] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1430.926222][T12354] attempt to access beyond end of device [ 1430.937441][T12354] loop5: rw=1, want=133, limit=128 [ 1430.962568][T12354] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1430.976781][T12354] attempt to access beyond end of device [ 1430.983574][T12354] loop5: rw=1, want=142, limit=128 [ 1430.994073][T12354] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1431.003788][T12354] attempt to access beyond end of device [ 1431.024574][T12354] loop5: rw=1, want=143, limit=128 [ 1431.030405][T12354] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1431.064549][T12354] attempt to access beyond end of device [ 1431.075067][T12354] loop5: rw=1, want=144, limit=128 [ 1431.087208][T12354] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1431.095896][T12354] attempt to access beyond end of device [ 1431.114804][T12354] loop5: rw=1, want=145, limit=128 01:29:39 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1000000000, 0x0, 0x5, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:39 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1431.142328][T12354] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1431.200180][T12354] attempt to access beyond end of device [ 1431.206013][T12354] loop5: rw=1, want=2833, limit=128 [ 1431.224745][T12354] attempt to access beyond end of device [ 1431.258005][T12354] loop5: rw=1, want=5481, limit=128 [ 1431.367642][T12372] attempt to access beyond end of device [ 1431.389989][T12372] loop0: rw=1, want=130, limit=128 [ 1431.398420][T12372] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1431.406978][T12372] attempt to access beyond end of device [ 1431.419584][T12354] attempt to access beyond end of device [ 1431.425461][T12354] loop5: rw=1, want=8617, limit=128 [ 1431.430983][T12372] loop0: rw=1, want=131, limit=128 [ 1431.445938][T12345] attempt to access beyond end of device [ 1431.451714][T12372] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1431.456027][T12354] attempt to access beyond end of device [ 1431.460333][T12345] loop5: rw=2049, want=8993, limit=128 [ 1431.469541][T12372] attempt to access beyond end of device [ 1431.477250][T12372] loop0: rw=1, want=132, limit=128 [ 1431.482522][T12372] attempt to access beyond end of device [ 1431.488912][T12372] loop0: rw=1, want=133, limit=128 [ 1431.493031][T12354] loop5: rw=1, want=8625, limit=128 [ 1431.494133][T12372] attempt to access beyond end of device [ 1431.506697][T12372] loop0: rw=1, want=142, limit=128 [ 1431.512082][T12372] attempt to access beyond end of device [ 1431.517812][T12372] loop0: rw=1, want=143, limit=128 [ 1431.530186][T12372] attempt to access beyond end of device [ 1431.535889][T12372] loop0: rw=1, want=144, limit=128 [ 1431.541292][T12372] attempt to access beyond end of device [ 1431.546995][T12372] loop0: rw=1, want=145, limit=128 [ 1431.556857][T12372] attempt to access beyond end of device [ 1431.562913][T12372] loop0: rw=1, want=2193, limit=128 [ 1431.573479][T12372] attempt to access beyond end of device [ 1431.579501][T12372] loop0: rw=1, want=4377, limit=128 [ 1431.608951][T12372] attempt to access beyond end of device [ 1431.614625][T12372] loop0: rw=1, want=5281, limit=128 01:29:40 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x7a00000000000000, 0x4) 01:29:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:40 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000000200"}) 01:29:40 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:40 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000000300"}) 01:29:40 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1431.965336][T12395] attempt to access beyond end of device [ 1431.991811][T12395] loop5: rw=1, want=130, limit=128 [ 1432.003553][T12395] attempt to access beyond end of device [ 1432.011226][T12395] loop5: rw=1, want=131, limit=128 [ 1432.016683][T12395] attempt to access beyond end of device [ 1432.022581][T12395] loop5: rw=1, want=132, limit=128 [ 1432.029421][T12395] attempt to access beyond end of device [ 1432.035352][T12395] loop5: rw=1, want=133, limit=128 [ 1432.041048][T12395] attempt to access beyond end of device [ 1432.046858][T12395] loop5: rw=1, want=142, limit=128 [ 1432.052781][T12395] attempt to access beyond end of device [ 1432.058669][T12395] loop5: rw=1, want=143, limit=128 [ 1432.063989][T12395] attempt to access beyond end of device [ 1432.069895][T12395] loop5: rw=1, want=144, limit=128 [ 1432.075321][T12395] attempt to access beyond end of device [ 1432.081186][T12395] loop5: rw=1, want=145, limit=128 [ 1432.089215][T12395] attempt to access beyond end of device [ 1432.095012][T12395] loop5: rw=1, want=601, limit=128 01:29:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1432.265442][T12367] attempt to access beyond end of device [ 1432.280981][T12367] loop0: rw=2049, want=7385, limit=128 01:29:41 executing program 0: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x9, 0x40) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003b00)=[{{&(0x7f00000000c0)=@ax25={{0x3, @null}, [@null, @rose, @default, @rose, @rose, @bcast, @netrom, @netrom]}, 0x80, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/187, 0xbb}, {&(0x7f0000000300)=""/104, 0x68}, {&(0x7f0000000280)}], 0x3, &(0x7f00000003c0)=""/206, 0xce}, 0x79074c2e}, {{&(0x7f00000004c0)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000000c40)=[{&(0x7f00000005c0)=""/203, 0xcb}, {&(0x7f00000006c0)=""/253, 0xfd}, {&(0x7f00000007c0)=""/162, 0xa2}, {&(0x7f0000000880)=""/211, 0xd3}, {&(0x7f0000000980)=""/191, 0xbf}, {&(0x7f0000000a40)=""/72, 0x48}, {&(0x7f0000000ac0)=""/48, 0x30}, {&(0x7f0000000b00)=""/238, 0xee}, {&(0x7f0000000c00)=""/34, 0x22}], 0x9, &(0x7f0000000d00)=""/74, 0x4a}, 0x9}, {{&(0x7f0000000d80)=@nfc_llcp, 0x80, &(0x7f0000000ec0)=[{&(0x7f0000000e00)=""/160, 0xa0}], 0x1, &(0x7f0000000f00)=""/196, 0xc4}, 0xc8ed}, {{&(0x7f0000001000)=@ipx, 0x80, &(0x7f00000010c0)=[{&(0x7f0000001080)=""/4, 0x4}], 0x1, &(0x7f0000001100)=""/249, 0xf9}, 0x60000000}, {{0x0, 0x0, &(0x7f0000001200)}, 0x81}, {{&(0x7f0000001240)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, 0x80, &(0x7f0000001540)=[{&(0x7f00000012c0)=""/93, 0x5d}, {&(0x7f0000001340)=""/150, 0x96}, {&(0x7f0000001400)}, {&(0x7f0000001440)}, {&(0x7f0000001480)=""/141, 0x8d}, {&(0x7f0000002600)=""/253, 0xfd}], 0x6, &(0x7f0000002700)=""/68, 0x44}, 0x5}, {{&(0x7f0000002780)=@alg, 0x80, &(0x7f0000002f40)=[{&(0x7f0000002800)=""/179, 0xb3}, {&(0x7f00000028c0)=""/82, 0x52}, {&(0x7f0000002940)=""/189, 0xbd}, {&(0x7f0000002a00)=""/243, 0xf3}, {&(0x7f0000002b00)=""/193, 0xc1}, {&(0x7f0000002c00)=""/105, 0x69}, {&(0x7f0000002c80)=""/132, 0x84}, {&(0x7f0000002d40)=""/200, 0xc8}, {&(0x7f0000002e40)=""/246, 0xf6}], 0x9, &(0x7f0000003000)=""/255, 0xff}, 0x9}, {{&(0x7f0000003100)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000003480)=[{&(0x7f0000003180)=""/90, 0x5a}, {&(0x7f0000003200)=""/209, 0xd1}, {&(0x7f0000003300)=""/4, 0x4}, {&(0x7f0000003340)=""/196, 0xc4}, {&(0x7f0000003440)=""/24, 0x18}], 0x5, &(0x7f0000003500)=""/94, 0x5e}, 0x9}, {{0x0, 0x0, &(0x7f0000003a80)=[{&(0x7f0000003580)=""/183, 0xb7}, {&(0x7f0000003640)=""/146, 0x92}, {&(0x7f0000003700)=""/219, 0xdb}, {&(0x7f0000003800)=""/22, 0x16}, {&(0x7f0000003840)=""/59, 0x3b}, {&(0x7f0000003880)=""/65, 0x41}, {&(0x7f0000003900)=""/85, 0x55}, {&(0x7f0000003980)=""/214, 0xd6}], 0x8}, 0x5}], 0x9, 0x2000, &(0x7f0000003d40)={0x77359400}) sendmsg$TEAM_CMD_OPTIONS_GET(r0, &(0x7f0000003f40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8101020}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x168, r1, 0x200, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x14c, 0x2, [{0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x10001}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x1000, 0x0, 0x3, 0x400}, {0x2, 0x8, 0x6, 0xffffffff}, {0x0, 0x8, 0x2, 0xffff}, {0x401, 0x3f, 0x3, 0x6}, {0x4, 0x20, 0xff, 0x1}, {0x800, 0x7f, 0x80, 0x3f}]}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xeff}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}]}, 0x168}, 0x1, 0x0, 0x0, 0x8010}, 0x4008190) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r3 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r3, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x2a67}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r3, 0x0, 0x0, 0x4) 01:29:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1432.340980][T12367] attempt to access beyond end of device [ 1432.346653][T12367] loop0: rw=2049, want=7585, limit=128 [ 1432.691551][T12425] attempt to access beyond end of device [ 1432.697437][T12425] loop0: rw=1, want=130, limit=128 [ 1432.718642][T12425] attempt to access beyond end of device [ 1432.724295][T12386] attempt to access beyond end of device [ 1432.724465][T12425] loop0: rw=1, want=131, limit=128 [ 1432.730329][T12386] loop5: rw=2049, want=2745, limit=128 [ 1432.751627][T12425] attempt to access beyond end of device [ 1432.753274][T12386] attempt to access beyond end of device [ 1432.764194][T12425] loop0: rw=1, want=132, limit=128 [ 1432.770323][T12425] attempt to access beyond end of device [ 1432.776303][T12425] loop0: rw=1, want=133, limit=128 [ 1432.782239][T12425] attempt to access beyond end of device [ 1432.785050][T12386] loop5: rw=2049, want=4881, limit=128 [ 1432.788021][T12425] loop0: rw=1, want=142, limit=128 [ 1432.799622][T12425] attempt to access beyond end of device [ 1432.805590][T12425] loop0: rw=1, want=143, limit=128 [ 1432.812847][T12425] attempt to access beyond end of device [ 1432.813429][T12386] attempt to access beyond end of device [ 1432.819173][T12425] loop0: rw=1, want=144, limit=128 [ 1432.830545][T12425] attempt to access beyond end of device [ 1432.836578][T12425] loop0: rw=1, want=145, limit=128 [ 1432.843790][T12386] loop5: rw=2049, want=6401, limit=128 01:29:41 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0xcf01000000000000, 0x4) 01:29:41 executing program 2: r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:41 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000000400"}) 01:29:41 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1432.881807][T12425] attempt to access beyond end of device [ 1432.916874][T12425] loop0: rw=1, want=2217, limit=128 01:29:41 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000000500"}) 01:29:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:41 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:41 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:42 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000000600"}) [ 1433.287630][T12425] attempt to access beyond end of device [ 1433.333028][T12425] loop0: rw=1, want=4545, limit=128 [ 1433.477927][T12425] attempt to access beyond end of device [ 1433.484642][T12425] loop0: rw=1, want=6169, limit=128 [ 1433.664324][T12420] attempt to access beyond end of device [ 1433.685974][T12420] loop0: rw=2049, want=6601, limit=128 01:29:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1433.988168][ C0] net_ratelimit: 19 callbacks suppressed [ 1433.988176][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1433.993935][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1434.078207][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1434.084038][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1434.089915][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1434.095685][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:29:42 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0xfffdffff00000000, 0x4) 01:29:42 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:42 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:29:42 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') mount(&(0x7f0000000080)=@sr0='/dev/sr0\x00', &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='qnx4\x00', 0x82000, &(0x7f00000001c0)='pagemap\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000200)={{0x5, 0x3f}, {0x3, 0x5}, 0x3, 0x1, 0x7}) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) getsockopt$bt_BT_FLUSHABLE(r3, 0x112, 0x8, &(0x7f0000000280)=0x3e90800, &(0x7f0000000340)=0x4) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r4, 0x0, 0xffffffff) getsockopt$bt_l2cap_L2CAP_LM(r4, 0x6, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1434.219476][ T27] audit: type=1800 audit(1577150982.963:87): pid=12560 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="sda1" ino=17569 res=0 01:29:43 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:29:43 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:29:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:43 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:29:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:43 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1435.188159][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1435.188265][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1435.194010][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1435.199741][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1435.447406][T12701] attempt to access beyond end of device [ 1435.453872][T12701] loop5: rw=2049, want=130, limit=128 [ 1435.459371][T12701] attempt to access beyond end of device [ 1435.465268][T12701] loop5: rw=2049, want=131, limit=128 [ 1435.470975][T12701] attempt to access beyond end of device [ 1435.476609][T12701] loop5: rw=2049, want=132, limit=128 [ 1435.482106][T12701] attempt to access beyond end of device [ 1435.487774][T12701] loop5: rw=2049, want=133, limit=128 [ 1435.493293][T12701] attempt to access beyond end of device [ 1435.499635][T12701] loop5: rw=2049, want=142, limit=128 [ 1435.505019][T12701] attempt to access beyond end of device [ 1435.510732][T12701] loop5: rw=2049, want=143, limit=128 [ 1435.516136][T12701] attempt to access beyond end of device [ 1435.521839][T12701] loop5: rw=2049, want=144, limit=128 [ 1435.527245][T12701] attempt to access beyond end of device [ 1435.532969][T12701] loop5: rw=2049, want=145, limit=128 [ 1435.540732][T12701] attempt to access beyond end of device 01:29:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0xffffffffffffffff, 0x4) 01:29:44 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0xa03c2, 0x0) read$FUSE(r1, &(0x7f00000005c0), 0x1000) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:44 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:29:44 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1435.546357][T12701] loop5: rw=2049, want=2193, limit=128 [ 1435.555579][T12701] attempt to access beyond end of device [ 1435.561613][T12701] loop5: rw=2049, want=4345, limit=128 [ 1435.571402][T12701] attempt to access beyond end of device [ 1435.577056][T12701] loop5: rw=2049, want=6393, limit=128 [ 1435.585298][T12701] attempt to access beyond end of device [ 1435.591839][T12701] loop5: rw=2049, want=8233, limit=128 01:29:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:44 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000fffffdfd00"}) 01:29:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1437.214773][T12970] attempt to access beyond end of device [ 1437.220473][T12970] loop5: rw=2049, want=130, limit=128 [ 1437.225889][T12970] buffer_io_error: 30 callbacks suppressed [ 1437.225895][T12970] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1437.240403][T12970] attempt to access beyond end of device [ 1437.246073][T12970] loop5: rw=2049, want=131, limit=128 [ 1437.251629][T12970] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1437.260243][T12970] attempt to access beyond end of device [ 1437.265873][T12970] loop5: rw=2049, want=132, limit=128 [ 1437.271663][T12970] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1437.280297][T12970] attempt to access beyond end of device [ 1437.285962][T12970] loop5: rw=2049, want=133, limit=128 [ 1437.291454][T12970] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1437.300045][T12970] attempt to access beyond end of device [ 1437.305673][T12970] loop5: rw=2049, want=142, limit=128 [ 1437.311119][T12970] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1437.320157][T12970] attempt to access beyond end of device [ 1437.325774][T12970] loop5: rw=2049, want=143, limit=128 [ 1437.331226][T12970] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1437.339805][T12970] attempt to access beyond end of device [ 1437.345432][T12970] loop5: rw=2049, want=144, limit=128 [ 1437.350875][T12970] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1437.359459][T12970] attempt to access beyond end of device [ 1437.365090][T12970] loop5: rw=2049, want=145, limit=128 [ 1437.370714][T12970] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1437.381380][T12970] attempt to access beyond end of device [ 1437.387019][T12970] loop5: rw=2049, want=2201, limit=128 [ 1437.395459][T12970] attempt to access beyond end of device [ 1437.401144][T12970] loop5: rw=2049, want=4249, limit=128 [ 1437.410968][T12970] attempt to access beyond end of device [ 1437.416605][T12970] loop5: rw=2049, want=6297, limit=128 [ 1437.425827][T12970] attempt to access beyond end of device [ 1437.432015][T12970] loop5: rw=2049, want=9033, limit=128 [ 1437.445610][T12970] attempt to access beyond end of device [ 1437.451277][T12970] loop5: rw=2049, want=13129, limit=128 01:29:46 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x2) 01:29:46 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000ff00"}) 01:29:46 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:46 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) getsockopt$TIPC_NODE_RECVQ_DEPTH(r2, 0x10f, 0x83, &(0x7f0000000000), &(0x7f0000000040)=0x4) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:29:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:46 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1437.468024][T12970] attempt to access beyond end of device [ 1437.473787][T12970] loop5: rw=2049, want=20057, limit=128 [ 1437.491331][T12970] attempt to access beyond end of device [ 1437.496977][T12970] loop5: rw=2049, want=28737, limit=128 01:29:46 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000ffffffff00"}) 01:29:46 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1437.841924][T13097] attempt to access beyond end of device [ 1437.867371][T13097] loop0: rw=1, want=130, limit=128 01:29:46 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:46 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000200"}) [ 1437.918779][T13097] Buffer I/O error on dev loop0, logical block 129, lost async page write 01:29:46 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1438.019687][T13097] attempt to access beyond end of device [ 1438.025553][T13097] loop0: rw=1, want=131, limit=128 01:29:46 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000300"}) [ 1438.108533][T13097] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1438.192131][T13097] attempt to access beyond end of device [ 1438.251262][T13097] loop0: rw=1, want=132, limit=128 [ 1438.290825][T13097] attempt to access beyond end of device [ 1438.334407][T13097] loop0: rw=1, want=133, limit=128 [ 1438.359636][T13097] attempt to access beyond end of device [ 1438.394783][T13097] loop0: rw=1, want=142, limit=128 [ 1438.455530][T13097] attempt to access beyond end of device [ 1438.486380][T13097] loop0: rw=1, want=143, limit=128 [ 1438.491739][T13097] attempt to access beyond end of device [ 1438.497381][T13097] loop0: rw=1, want=144, limit=128 [ 1438.509400][T13097] attempt to access beyond end of device [ 1438.515055][T13097] loop0: rw=1, want=145, limit=128 [ 1438.558231][T12992] attempt to access beyond end of device [ 1438.585864][T12992] loop0: rw=2049, want=1225, limit=128 [ 1438.598542][T13097] attempt to access beyond end of device [ 1438.604757][T13097] loop0: rw=1, want=2409, limit=128 [ 1438.657237][T12992] attempt to access beyond end of device [ 1438.668677][T12992] loop0: rw=2049, want=5289, limit=128 [ 1438.676802][T13097] attempt to access beyond end of device [ 1438.689103][T13097] loop0: rw=1, want=5337, limit=128 [ 1438.694628][T12992] attempt to access beyond end of device [ 1438.705829][T12992] loop0: rw=2049, want=5345, limit=128 [ 1438.712865][T13097] attempt to access beyond end of device [ 1438.724103][T13097] loop0: rw=1, want=5353, limit=128 [ 1438.730936][T12992] attempt to access beyond end of device [ 1438.736758][T12992] loop0: rw=2049, want=5361, limit=128 [ 1438.747981][T13097] attempt to access beyond end of device [ 1438.755935][T13097] loop0: rw=1, want=5369, limit=128 [ 1438.766839][T12992] attempt to access beyond end of device [ 1438.773834][T12992] loop0: rw=2049, want=5377, limit=128 [ 1438.785088][T13097] attempt to access beyond end of device [ 1438.792216][T13097] loop0: rw=1, want=5385, limit=128 [ 1438.797682][T12992] attempt to access beyond end of device [ 1438.803829][T12992] loop0: rw=2049, want=5393, limit=128 [ 1438.809783][T13097] attempt to access beyond end of device [ 1438.815590][T13097] loop0: rw=1, want=5401, limit=128 [ 1438.821116][T12992] attempt to access beyond end of device [ 1438.826935][T12992] loop0: rw=2049, want=5409, limit=128 [ 1438.832698][T13097] attempt to access beyond end of device [ 1438.838700][T13097] loop0: rw=1, want=5417, limit=128 [ 1438.844162][T12992] attempt to access beyond end of device [ 1438.850046][T12992] loop0: rw=2049, want=5425, limit=128 [ 1438.855760][T13097] attempt to access beyond end of device [ 1438.862464][T13097] loop0: rw=1, want=5433, limit=128 [ 1438.867926][T12992] attempt to access beyond end of device [ 1438.873839][T12992] loop0: rw=2049, want=5441, limit=128 [ 1438.879603][T13097] attempt to access beyond end of device [ 1438.885407][T13097] loop0: rw=1, want=5449, limit=128 [ 1438.890923][T12992] attempt to access beyond end of device [ 1438.896746][T12992] loop0: rw=2049, want=5457, limit=128 [ 1438.902502][T13097] attempt to access beyond end of device [ 1438.908402][T13097] loop0: rw=1, want=5465, limit=128 [ 1438.913877][T12992] attempt to access beyond end of device [ 1438.919734][T12992] loop0: rw=2049, want=5473, limit=128 [ 1438.925475][T13097] attempt to access beyond end of device [ 1438.931326][T13097] loop0: rw=1, want=5481, limit=128 [ 1438.936797][T12992] attempt to access beyond end of device [ 1438.942662][T12992] loop0: rw=2049, want=5489, limit=128 [ 1438.948470][T13097] attempt to access beyond end of device [ 1438.954288][T13097] loop0: rw=1, want=5497, limit=128 [ 1438.959844][T12992] attempt to access beyond end of device [ 1438.965671][T12992] loop0: rw=2049, want=5505, limit=128 [ 1438.972762][T13097] attempt to access beyond end of device [ 1438.978904][T13097] loop0: rw=1, want=5513, limit=128 [ 1438.984422][T12992] attempt to access beyond end of device [ 1438.990285][T12992] loop0: rw=2049, want=5521, limit=128 [ 1438.996244][T13097] attempt to access beyond end of device [ 1439.002268][T13097] loop0: rw=1, want=5529, limit=128 [ 1439.007733][T12992] attempt to access beyond end of device [ 1439.013755][T12992] loop0: rw=2049, want=5537, limit=128 [ 1439.019537][T13097] attempt to access beyond end of device [ 1439.025509][T13097] loop0: rw=1, want=5545, limit=128 [ 1439.031227][T12992] attempt to access beyond end of device [ 1439.037042][T12992] loop0: rw=2049, want=5553, limit=128 [ 1439.042996][T13097] attempt to access beyond end of device [ 1439.048987][T13097] loop0: rw=1, want=5561, limit=128 [ 1439.054640][T12992] attempt to access beyond end of device [ 1439.060655][T12992] loop0: rw=2049, want=5569, limit=128 [ 1439.066382][T13097] attempt to access beyond end of device [ 1439.072477][T13097] loop0: rw=1, want=5577, limit=128 [ 1439.077996][T12992] attempt to access beyond end of device [ 1439.084996][T12992] loop0: rw=2049, want=5585, limit=128 [ 1439.090952][T13097] attempt to access beyond end of device [ 1439.096752][T13097] loop0: rw=1, want=5593, limit=128 [ 1439.102532][T12992] attempt to access beyond end of device [ 1439.128140][T12992] loop0: rw=2049, want=5601, limit=128 [ 1439.135636][T13097] attempt to access beyond end of device [ 1439.147068][T13097] loop0: rw=1, want=5609, limit=128 [ 1439.154320][T12992] attempt to access beyond end of device [ 1439.165273][T12992] loop0: rw=2049, want=5649, limit=128 [ 1439.177789][T13097] attempt to access beyond end of device [ 1439.183917][T13097] loop0: rw=1, want=5753, limit=128 [ 1439.196167][T12992] attempt to access beyond end of device [ 1439.202293][T12992] loop0: rw=2049, want=5761, limit=128 [ 1439.208002][T13097] attempt to access beyond end of device [ 1439.221515][T13097] loop0: rw=1, want=5769, limit=128 [ 1439.227259][T12992] attempt to access beyond end of device [ 1439.236657][T12992] loop0: rw=2049, want=5777, limit=128 [ 1439.246453][T13097] attempt to access beyond end of device [ 1439.255805][T13097] loop0: rw=1, want=5785, limit=128 [ 1439.265315][T12992] attempt to access beyond end of device [ 1439.274191][T12992] loop0: rw=2049, want=5793, limit=128 [ 1439.287090][T13097] attempt to access beyond end of device [ 1439.293183][T13097] loop0: rw=1, want=5873, limit=128 [ 1439.305537][T12992] attempt to access beyond end of device [ 1439.311655][T12992] loop0: rw=2049, want=5881, limit=128 [ 1439.317389][T13097] attempt to access beyond end of device [ 1439.330172][T13097] loop0: rw=1, want=5889, limit=128 [ 1439.335987][T12992] attempt to access beyond end of device [ 1439.344581][T12992] loop0: rw=2049, want=5897, limit=128 [ 1439.348165][ C1] net_ratelimit: 20 callbacks suppressed [ 1439.348172][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1439.350274][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1439.355723][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1439.361451][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1439.388615][T12992] attempt to access beyond end of device [ 1439.390009][T13097] attempt to access beyond end of device [ 1439.394366][T12992] loop0: rw=2049, want=6193, limit=128 [ 1439.400341][T13097] loop0: rw=1, want=5993, limit=128 [ 1439.470610][T13127] attempt to access beyond end of device [ 1439.476282][T13127] loop5: rw=2049, want=130, limit=128 [ 1439.498393][T13127] attempt to access beyond end of device [ 1439.504056][T13127] loop5: rw=2049, want=131, limit=128 [ 1439.518996][T13127] attempt to access beyond end of device [ 1439.524663][T13127] loop5: rw=2049, want=132, limit=128 [ 1439.530234][T13127] attempt to access beyond end of device [ 1439.535880][T13127] loop5: rw=2049, want=133, limit=128 [ 1439.541387][T13127] attempt to access beyond end of device [ 1439.547094][T13127] loop5: rw=2049, want=142, limit=128 [ 1439.552885][T13127] attempt to access beyond end of device [ 1439.558602][T13127] loop5: rw=2049, want=143, limit=128 [ 1439.564055][T13127] attempt to access beyond end of device [ 1439.569808][T13127] loop5: rw=2049, want=144, limit=128 [ 1439.575199][T13127] attempt to access beyond end of device [ 1439.580938][T13127] loop5: rw=2049, want=145, limit=128 [ 1439.589399][T13127] attempt to access beyond end of device [ 1439.595053][T13127] loop5: rw=2049, want=2753, limit=128 [ 1439.603618][T13127] attempt to access beyond end of device [ 1439.609322][T13127] loop5: rw=2049, want=4801, limit=128 [ 1439.620991][T13127] attempt to access beyond end of device [ 1439.626651][T13127] loop5: rw=2049, want=7769, limit=128 [ 1439.647084][T13127] attempt to access beyond end of device [ 1439.652804][T13127] loop5: rw=2049, want=11857, limit=128 [ 1439.673153][T13127] attempt to access beyond end of device [ 1439.679108][T13127] loop5: rw=2049, want=17809, limit=128 [ 1439.696911][T13127] attempt to access beyond end of device [ 1439.702604][T13127] loop5: rw=2049, want=28849, limit=128 01:29:48 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x3) 01:29:48 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:48 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000400"}) 01:29:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:48 executing program 0: chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimes(&(0x7f0000000000)='./bus\x00', &(0x7f0000000080)={{0x0, 0x2710}, {r1, r2/1000+10000}}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1439.718288][T13127] attempt to access beyond end of device [ 1439.723962][T13127] loop5: rw=2049, want=31337, limit=128 01:29:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) 01:29:48 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000500"}) 01:29:48 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:48 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) 01:29:48 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000600"}) [ 1440.148158][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1440.154019][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:29:49 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) [ 1440.238172][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1440.244014][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1440.308215][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1440.314021][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1441.505004][T13178] attempt to access beyond end of device [ 1441.510798][T13178] loop5: rw=2049, want=130, limit=128 [ 1441.516192][T13178] attempt to access beyond end of device [ 1441.521897][T13178] loop5: rw=2049, want=131, limit=128 [ 1441.527294][T13178] attempt to access beyond end of device [ 1441.532995][T13178] loop5: rw=2049, want=132, limit=128 [ 1441.538443][T13178] attempt to access beyond end of device [ 1441.544059][T13178] loop5: rw=2049, want=133, limit=128 [ 1441.549520][T13178] attempt to access beyond end of device [ 1441.555146][T13178] loop5: rw=2049, want=142, limit=128 [ 1441.560617][T13178] attempt to access beyond end of device [ 1441.566244][T13178] loop5: rw=2049, want=143, limit=128 [ 1441.571863][T13178] attempt to access beyond end of device [ 1441.577494][T13178] loop5: rw=2049, want=144, limit=128 [ 1441.582954][T13178] attempt to access beyond end of device [ 1441.588706][T13178] loop5: rw=2049, want=145, limit=128 [ 1441.597055][T13178] attempt to access beyond end of device [ 1441.602883][T13178] loop5: rw=2049, want=3249, limit=128 [ 1441.612097][T13178] attempt to access beyond end of device [ 1441.617753][T13178] loop5: rw=2049, want=5313, limit=128 [ 1441.626359][T13178] attempt to access beyond end of device [ 1441.632076][T13178] loop5: rw=2049, want=7361, limit=128 [ 1441.642112][T13178] attempt to access beyond end of device [ 1441.647762][T13178] loop5: rw=2049, want=9409, limit=128 [ 1441.657615][T13178] attempt to access beyond end of device [ 1441.663311][T13178] loop5: rw=2049, want=13017, limit=128 [ 1441.676968][T13178] attempt to access beyond end of device [ 1441.682663][T13178] loop5: rw=2049, want=17129, limit=128 [ 1441.699288][T13178] attempt to access beyond end of device [ 1441.704940][T13178] loop5: rw=2049, want=24489, limit=128 [ 1441.730823][T13178] attempt to access beyond end of device [ 1441.741256][T13178] loop5: rw=2049, want=32881, limit=128 [ 1441.756608][T13180] attempt to access beyond end of device [ 1441.762385][T13180] loop5: rw=2049, want=130, limit=128 [ 1441.767799][T13180] attempt to access beyond end of device [ 1441.773534][T13180] loop5: rw=2049, want=131, limit=128 [ 1441.779179][T13180] attempt to access beyond end of device [ 1441.784801][T13180] loop5: rw=2049, want=132, limit=128 [ 1441.790279][T13180] attempt to access beyond end of device [ 1441.795904][T13180] loop5: rw=2049, want=133, limit=128 [ 1441.801878][T13180] attempt to access beyond end of device [ 1441.807503][T13180] loop5: rw=2049, want=142, limit=128 [ 1441.813142][T13180] attempt to access beyond end of device [ 1441.818881][T13180] loop5: rw=2049, want=143, limit=128 [ 1441.824292][T13180] attempt to access beyond end of device 01:29:50 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x5) 01:29:50 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:29:50 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) 01:29:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:50 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) ioctl$VIDIOC_SUBDEV_G_CROP(r2, 0xc038563b, &(0x7f0000000000)={0x2, 0x0, {0xc2, 0x5, 0xfffffffd, 0x1}}) [ 1441.830613][T13180] loop5: rw=2049, want=144, limit=128 [ 1441.836022][T13180] attempt to access beyond end of device [ 1441.841724][T13180] loop5: rw=2049, want=145, limit=128 [ 1441.848272][T13180] attempt to access beyond end of device [ 1441.853915][T13180] loop5: rw=2049, want=1169, limit=128 01:29:50 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:29:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:50 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:29:50 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) 01:29:50 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000800100"}) 01:29:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1443.567214][T13328] attempt to access beyond end of device [ 1443.572976][T13328] loop5: rw=2049, want=130, limit=128 [ 1443.578449][T13328] buffer_io_error: 30 callbacks suppressed [ 1443.578465][T13328] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1443.593382][T13328] attempt to access beyond end of device [ 1443.599121][T13328] loop5: rw=2049, want=131, limit=128 [ 1443.604512][T13328] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1443.613108][T13328] attempt to access beyond end of device [ 1443.618805][T13328] loop5: rw=2049, want=132, limit=128 [ 1443.624290][T13328] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1443.632874][T13328] attempt to access beyond end of device [ 1443.638568][T13328] loop5: rw=2049, want=133, limit=128 [ 1443.643939][T13328] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1443.652571][T13328] attempt to access beyond end of device [ 1443.658234][T13328] loop5: rw=2049, want=142, limit=128 [ 1443.663590][T13328] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1443.672345][T13328] attempt to access beyond end of device [ 1443.677972][T13328] loop5: rw=2049, want=143, limit=128 [ 1443.683393][T13328] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1443.691966][T13328] attempt to access beyond end of device [ 1443.697585][T13328] loop5: rw=2049, want=144, limit=128 [ 1443.703594][T13328] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1443.712168][T13328] attempt to access beyond end of device [ 1443.717792][T13328] loop5: rw=2049, want=145, limit=128 [ 1443.723213][T13328] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1443.734093][T13328] attempt to access beyond end of device [ 1443.739816][T13328] loop5: rw=2049, want=2489, limit=128 [ 1443.748427][T13328] attempt to access beyond end of device [ 1443.754078][T13328] loop5: rw=2049, want=4537, limit=128 [ 1443.762531][T13328] attempt to access beyond end of device [ 1443.768210][T13328] loop5: rw=2049, want=6585, limit=128 [ 1443.778357][T13328] attempt to access beyond end of device [ 1443.784014][T13328] loop5: rw=2049, want=8633, limit=128 [ 1443.796887][T13328] attempt to access beyond end of device [ 1443.802608][T13328] loop5: rw=2049, want=12361, limit=128 [ 1443.818684][T13328] attempt to access beyond end of device [ 1443.824352][T13328] loop5: rw=2049, want=16457, limit=128 [ 1443.844671][T13328] attempt to access beyond end of device [ 1443.850525][T13328] loop5: rw=2049, want=23321, limit=128 [ 1443.870422][T13328] attempt to access beyond end of device [ 1443.876070][T13328] loop5: rw=2049, want=32881, limit=128 [ 1443.886313][T13332] attempt to access beyond end of device [ 1443.892046][T13332] loop5: rw=2049, want=130, limit=128 [ 1443.897415][T13332] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1443.906504][T13332] attempt to access beyond end of device [ 1443.912294][T13332] loop5: rw=2049, want=131, limit=128 [ 1443.917672][T13332] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1443.926913][T13332] attempt to access beyond end of device [ 1443.932613][T13332] loop5: rw=2049, want=132, limit=128 [ 1443.938002][T13332] attempt to access beyond end of device [ 1443.943718][T13332] loop5: rw=2049, want=133, limit=128 [ 1443.949172][T13332] attempt to access beyond end of device [ 1443.954842][T13332] loop5: rw=2049, want=142, limit=128 [ 1443.960305][T13332] attempt to access beyond end of device [ 1443.965933][T13332] loop5: rw=2049, want=143, limit=128 [ 1443.971371][T13332] attempt to access beyond end of device [ 1443.976998][T13332] loop5: rw=2049, want=144, limit=128 [ 1443.982485][T13332] attempt to access beyond end of device [ 1443.988271][T13332] loop5: rw=2049, want=145, limit=128 [ 1443.995831][T13332] attempt to access beyond end of device [ 1444.001554][T13332] loop5: rw=2049, want=2489, limit=128 [ 1444.011403][T13332] attempt to access beyond end of device 01:29:52 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x6) 01:29:52 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:52 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000300"}) 01:29:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) 01:29:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:52 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fstat(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$hfs(&(0x7f0000000000)='hfs\x00', &(0x7f0000000040)='./file1\x00', 0xc75, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000080)="986adde208a34c0ac4abf0468e91", 0xe, 0x3}, {&(0x7f00000001c0)="a80c367914bc893fdc00fc88d29491858132b29c0c3c94d7638baf6c2b7f271044a23e1b366d6bf9102887daca72e1844e11179ecfa249a790c64542d4976e8e91fa88ac340aab7503af70df91ffa352d8cbfc5a5f5ba3eeeca3ae03b7e3dec57cece9b11635aaf1343e27fd8a03d3a75b0c4478a9b3d9922d4e3274236a6793633c3c", 0x83, 0x4}, {&(0x7f0000000300)="df3990c7a1bb866eba4bb123ba66a0887dc07612726c75b56a9f0c9cd1477a8f150761df81986fb97151d533c72d7cddc7fdcb4fbdcd433d2e9d633663792918561cda5b9faf6ee5f050421754c3da17eb794cb35243fbd4d77baa3e36f4fc11ff52f85de10190d53324c53395a183f676a4663246d3417f8f292287713afb521ecc909f339268aa78975d6bcefb3bf16381d0c0fb384b0d11d21fe411fbff585a4be792f762ae007d41cc9ba6b8790721174f6f6c9b3b839e664359b0dd8235", 0xc0, 0x100000001}, {&(0x7f00000000c0)="e77a956bf7", 0x5, 0x7}, {&(0x7f0000000100)="e1fd4fefc3c798df1bea04967fd7897a951257d2191882c6ce7435369f08936f9b1b7d3a5a513c5b4c793f0f1ebe596e4c0d995f308ee91f98993d927f34557b", 0x40, 0x3}, {&(0x7f00000003c0)="494eae7af6cf845aa481e049b43a0fcc90a129ffa53d1a2dabd56b1c115ece889c536735433759333455d1e3606f929461fc30844d6b22bf736f401a470d02401122d0b37fd8d290ee41ae6115094de4e7fc93c7f1315f9714b7de195f69a3107934aa9d516f802d7993d9b864a0de347f5419a83cf41cd1d1799d8cedceae1b9e04e7d2e0894358d24fe526a6baa79878dfa0ddb7355e1f21545b6e0f80777b3a03ae879f8bf4317710e745484a5789e7415a2901f6790df438d7936b19a404d548f8d502bb7f2c3fc114afebfc005c7043a79a70c1fefe9abe3851730987837bd7f7fb100112ea18bead331b09", 0xee, 0x4}], 0x20, &(0x7f0000000280)={[{@quiet='quiet'}], [{@dont_appraise='dont_appraise'}, {@dont_measure='dont_measure'}, {@fowner_gt={'fowner>', r1}}]}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1444.017045][T13332] loop5: rw=2049, want=4537, limit=128 [ 1444.024501][T13332] attempt to access beyond end of device [ 1444.030701][T13332] loop5: rw=2049, want=5665, limit=128 01:29:52 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000500"}) 01:29:53 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000600"}) [ 1444.298993][T13350] attempt to access beyond end of device 01:29:53 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) [ 1444.372174][T13350] loop0: rw=1, want=130, limit=128 [ 1444.388198][ C0] net_ratelimit: 19 callbacks suppressed [ 1444.388206][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1444.399659][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1444.438789][T13350] attempt to access beyond end of device [ 1444.461764][T13350] loop0: rw=1, want=131, limit=128 [ 1444.468196][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1444.473992][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1444.479848][ C0] protocol 88fb is buggy, dev hsr_slave_0 01:29:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) [ 1444.485613][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1444.540708][T13350] attempt to access beyond end of device [ 1444.546571][T13350] loop0: rw=1, want=132, limit=128 01:29:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1444.668270][T13350] attempt to access beyond end of device [ 1444.696116][T13350] loop0: rw=1, want=133, limit=128 [ 1444.778689][T13350] attempt to access beyond end of device [ 1444.821280][T13350] loop0: rw=1, want=142, limit=128 [ 1444.848730][T13350] attempt to access beyond end of device [ 1444.876173][T13350] loop0: rw=1, want=143, limit=128 [ 1444.921663][T13350] attempt to access beyond end of device [ 1444.949343][T13350] loop0: rw=1, want=144, limit=128 [ 1444.954600][T13350] attempt to access beyond end of device [ 1444.970542][T13350] loop0: rw=1, want=145, limit=128 [ 1445.050488][T13350] attempt to access beyond end of device [ 1445.056281][T13350] loop0: rw=1, want=1089, limit=128 [ 1445.069178][T13342] attempt to access beyond end of device [ 1445.074923][T13342] loop0: rw=2049, want=2177, limit=128 [ 1445.091390][T13350] attempt to access beyond end of device [ 1445.097349][T13350] loop0: rw=1, want=2185, limit=128 [ 1445.102946][T13342] attempt to access beyond end of device [ 1445.108777][T13342] loop0: rw=2049, want=2193, limit=128 [ 1445.114430][T13350] attempt to access beyond end of device [ 1445.120444][T13350] loop0: rw=1, want=2201, limit=128 [ 1445.130052][T13350] attempt to access beyond end of device [ 1445.135693][T13350] loop0: rw=1, want=4449, limit=128 [ 1445.144653][T13342] attempt to access beyond end of device [ 1445.150741][T13342] loop0: rw=2049, want=2209, limit=128 [ 1445.156357][T13350] attempt to access beyond end of device [ 1445.162204][T13350] loop0: rw=1, want=5297, limit=128 [ 1445.175919][T13350] attempt to access beyond end of device [ 1445.176447][T13342] attempt to access beyond end of device [ 1445.181716][T13350] loop0: rw=1, want=5769, limit=128 [ 1445.233132][T13342] loop0: rw=2049, want=5321, limit=128 [ 1445.588192][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1445.593975][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1445.598210][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1445.605447][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1445.854734][T13481] attempt to access beyond end of device [ 1445.860490][T13481] loop5: rw=2049, want=130, limit=128 [ 1445.865875][T13481] attempt to access beyond end of device [ 1445.871552][T13481] loop5: rw=2049, want=131, limit=128 [ 1445.877045][T13481] attempt to access beyond end of device [ 1445.882744][T13481] loop5: rw=2049, want=132, limit=128 [ 1445.888176][T13481] attempt to access beyond end of device [ 1445.893793][T13481] loop5: rw=2049, want=133, limit=128 [ 1445.904254][T13481] attempt to access beyond end of device [ 1445.909997][T13481] loop5: rw=2049, want=3845, limit=128 [ 1445.919726][T13481] attempt to access beyond end of device [ 1445.925370][T13481] loop5: rw=2049, want=5893, limit=128 [ 1445.933899][T13481] attempt to access beyond end of device [ 1445.939610][T13481] loop5: rw=2049, want=7941, limit=128 [ 1445.949092][T13481] attempt to access beyond end of device [ 1445.954746][T13481] loop5: rw=2049, want=10813, limit=128 [ 1445.965636][T13481] attempt to access beyond end of device [ 1445.971525][T13481] loop5: rw=2049, want=14909, limit=128 [ 1445.986994][T13481] attempt to access beyond end of device [ 1445.992752][T13481] loop5: rw=2049, want=19965, limit=128 [ 1446.009740][T13481] attempt to access beyond end of device [ 1446.015396][T13481] loop5: rw=2049, want=28349, limit=128 [ 1446.029117][T13481] attempt to access beyond end of device [ 1446.036186][T13481] loop5: rw=2049, want=32877, limit=128 01:29:54 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x7) 01:29:54 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) 01:29:54 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:54 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:29:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:54 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7, 0xaaaab18, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16, 0x4000}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1446.089828][ T27] audit: type=1800 audit(1577150994.833:88): pid=13486 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="loop5" ino=510 res=0 01:29:55 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) 01:29:55 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:29:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:55 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:55 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000ff00"}) 01:29:55 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) [ 1447.849520][T13630] attempt to access beyond end of device [ 1447.855177][T13630] loop5: rw=2049, want=130, limit=128 [ 1447.860655][T13630] attempt to access beyond end of device [ 1447.866282][T13630] loop5: rw=2049, want=131, limit=128 [ 1447.871902][T13630] attempt to access beyond end of device [ 1447.877530][T13630] loop5: rw=2049, want=132, limit=128 [ 1447.883718][T13630] attempt to access beyond end of device [ 1447.889440][T13630] loop5: rw=2049, want=133, limit=128 [ 1447.894836][T13630] attempt to access beyond end of device [ 1447.900630][T13630] loop5: rw=2049, want=142, limit=128 [ 1447.906116][T13630] attempt to access beyond end of device [ 1447.911816][T13630] loop5: rw=2049, want=143, limit=128 [ 1447.917317][T13630] attempt to access beyond end of device [ 1447.923109][T13630] loop5: rw=2049, want=144, limit=128 [ 1447.928610][T13630] attempt to access beyond end of device [ 1447.934237][T13630] loop5: rw=2049, want=145, limit=128 [ 1447.943642][T13630] attempt to access beyond end of device [ 1447.949324][T13630] loop5: rw=2049, want=2761, limit=128 [ 1447.957765][T13630] attempt to access beyond end of device [ 1447.963451][T13630] loop5: rw=2049, want=4809, limit=128 [ 1447.972822][T13630] attempt to access beyond end of device [ 1447.978530][T13630] loop5: rw=2049, want=6857, limit=128 [ 1447.986745][T13630] attempt to access beyond end of device [ 1447.993145][T13630] loop5: rw=2049, want=8905, limit=128 [ 1448.003548][T13630] attempt to access beyond end of device [ 1448.009243][T13630] loop5: rw=2049, want=11785, limit=128 [ 1448.021286][T13630] attempt to access beyond end of device [ 1448.026932][T13630] loop5: rw=2049, want=15881, limit=128 [ 1448.043052][T13630] attempt to access beyond end of device [ 1448.048845][T13630] loop5: rw=2049, want=23081, limit=128 [ 1448.069392][T13630] attempt to access beyond end of device [ 1448.075041][T13630] loop5: rw=2049, want=32881, limit=128 01:29:56 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0xf) 01:29:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) 01:29:56 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000100"}) 01:29:56 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x52, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000009000/0xf000)=nil, 0xf000, 0x4800103, 0x10, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00004f9fe4)={0xe, 0x4, 0x4, 0xed, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x1}, 0x3c) pipe2(0x0, 0x3feb9199aee7c3e9) 01:29:56 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./bus\x00', 0x0, 0x10}, 0x10) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1448.158895][ T27] audit: type=1800 audit(1577150996.903:89): pid=13633 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.5" name="bus" dev="loop5" ino=511 res=0 01:29:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000800100"}) 01:29:57 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) 01:29:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000200"}) 01:29:57 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000180)={0x0, {0x2, 0x0, @multicast2}, {0x2, 0x0, @remote}, {0x2, 0x4000, @empty}, 0x36, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x2}) 01:29:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000300"}) [ 1448.512592][T13659] attempt to access beyond end of device 01:29:57 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) [ 1448.599882][T13659] loop0: rw=1, want=130, limit=128 [ 1448.670958][T13659] buffer_io_error: 26 callbacks suppressed [ 1448.671005][T13659] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1448.751047][T13659] attempt to access beyond end of device [ 1448.799343][T13659] loop0: rw=1, want=131, limit=128 [ 1448.824659][T13659] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1448.863140][T13659] attempt to access beyond end of device [ 1448.884942][T13659] loop0: rw=1, want=132, limit=128 [ 1448.896704][T13659] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1448.916870][T13659] attempt to access beyond end of device [ 1448.958273][T13659] loop0: rw=1, want=133, limit=128 [ 1448.963517][T13659] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1448.972715][T13659] attempt to access beyond end of device [ 1448.988272][T13659] loop0: rw=1, want=142, limit=128 [ 1448.993591][T13659] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1449.018548][T13659] attempt to access beyond end of device [ 1449.024393][T13659] loop0: rw=1, want=143, limit=128 [ 1449.038248][T13659] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1449.067097][T13659] attempt to access beyond end of device [ 1449.103918][T13659] loop0: rw=1, want=144, limit=128 [ 1449.147975][T13659] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1449.169738][T13659] attempt to access beyond end of device [ 1449.170296][T13643] attempt to access beyond end of device [ 1449.175412][T13659] loop0: rw=1, want=145, limit=128 [ 1449.175429][T13659] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1449.195463][T13643] loop0: rw=2049, want=2609, limit=128 [ 1449.203210][T13643] attempt to access beyond end of device [ 1449.219044][T13643] loop0: rw=2049, want=2665, limit=128 [ 1449.258723][T13659] attempt to access beyond end of device [ 1449.264420][T13659] loop0: rw=1, want=2729, limit=128 [ 1449.275346][T13659] attempt to access beyond end of device [ 1449.293347][T13643] attempt to access beyond end of device [ 1449.306483][T13643] loop0: rw=2049, want=5425, limit=128 [ 1449.315643][T13659] loop0: rw=1, want=6625, limit=128 [ 1449.748191][ C1] net_ratelimit: 20 callbacks suppressed [ 1449.748201][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1449.748242][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1449.753901][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1449.999260][T13679] attempt to access beyond end of device [ 1450.004913][T13679] loop5: rw=2049, want=130, limit=128 [ 1450.010358][T13679] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1450.018947][T13679] attempt to access beyond end of device [ 1450.024579][T13679] loop5: rw=2049, want=131, limit=128 [ 1450.030040][T13679] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1450.038633][T13679] attempt to access beyond end of device [ 1450.044262][T13679] loop5: rw=2049, want=132, limit=128 [ 1450.049735][T13679] attempt to access beyond end of device [ 1450.055447][T13679] loop5: rw=2049, want=133, limit=128 [ 1450.060885][T13679] attempt to access beyond end of device [ 1450.066510][T13679] loop5: rw=2049, want=142, limit=128 [ 1450.071985][T13679] attempt to access beyond end of device [ 1450.077715][T13679] loop5: rw=2049, want=143, limit=128 [ 1450.083180][T13679] attempt to access beyond end of device [ 1450.088865][T13679] loop5: rw=2049, want=144, limit=128 [ 1450.088912][T13679] attempt to access beyond end of device [ 1450.088925][T13679] loop5: rw=2049, want=145, limit=128 [ 1450.092734][T13679] attempt to access beyond end of device [ 1450.111936][T13679] loop5: rw=2049, want=2705, limit=128 [ 1450.122639][T13679] attempt to access beyond end of device [ 1450.143940][T13679] loop5: rw=2049, want=4761, limit=128 [ 1450.153595][T13679] attempt to access beyond end of device [ 1450.159333][T13679] loop5: rw=2049, want=6809, limit=128 [ 1450.168894][T13679] attempt to access beyond end of device [ 1450.174559][T13679] loop5: rw=2049, want=9969, limit=128 [ 1450.185073][T13679] attempt to access beyond end of device [ 1450.190971][T13679] loop5: rw=2049, want=14065, limit=128 [ 1450.206147][T13679] attempt to access beyond end of device [ 1450.211833][T13679] loop5: rw=2049, want=20625, limit=128 [ 1450.235404][T13679] attempt to access beyond end of device [ 1450.250765][T13679] loop5: rw=2049, want=32209, limit=128 [ 1450.264817][T13679] attempt to access beyond end of device [ 1450.270639][T13679] loop5: rw=2049, want=32881, limit=128 [ 1450.277085][T13684] attempt to access beyond end of device [ 1450.282849][T13684] loop5: rw=2049, want=130, limit=128 [ 1450.288360][T13684] attempt to access beyond end of device [ 1450.293996][T13684] loop5: rw=2049, want=131, limit=128 [ 1450.299523][T13684] attempt to access beyond end of device [ 1450.305337][T13684] loop5: rw=2049, want=132, limit=128 [ 1450.310790][T13684] attempt to access beyond end of device [ 1450.316423][T13684] loop5: rw=2049, want=133, limit=128 [ 1450.322001][T13684] attempt to access beyond end of device [ 1450.327631][T13684] loop5: rw=2049, want=142, limit=128 [ 1450.333827][T13684] attempt to access beyond end of device [ 1450.343242][T13684] loop5: rw=2049, want=143, limit=128 [ 1450.349320][T13684] attempt to access beyond end of device [ 1450.355001][T13684] loop5: rw=2049, want=144, limit=128 01:29:59 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x10) 01:29:59 executing program 1: r0 = socket(0x10, 0x80002, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv6_deladdr={0x2c, 0x15, 0x1617, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @mcast1}]}, 0x2c}}, 0x0) 01:29:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000400"}) 01:29:59 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) 01:29:59 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:29:59 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x3) chdir(&(0x7f0000000040)='./bus\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r4, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r5}) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r6, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r7}) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r8}) clock_gettime(0x0, &(0x7f0000005880)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000005740)=[{{&(0x7f0000000240)=@x25={0x9, @remote}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000300)=""/186, 0xba}, {&(0x7f00000003c0)=""/107, 0x6b}, {&(0x7f00000005c0)=""/4096, 0x77e}, {&(0x7f0000000440)=""/92, 0x5c}, {&(0x7f0000002600)=""/145, 0x91}], 0x5, &(0x7f00000026c0)=""/127, 0x7f}, 0x8}, {{&(0x7f0000002740)=@xdp, 0x80, &(0x7f0000002880)=[{&(0x7f00000027c0)=""/45, 0x2d}, {&(0x7f0000002800)=""/123, 0x7b}], 0x2, &(0x7f0000006040)=""/90, 0x50}, 0x2}, {{&(0x7f0000002940)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002c40), 0x4}, 0x2}, {{&(0x7f0000002c80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f0000003180)=[{&(0x7f0000002d00)=""/119, 0x77}, {&(0x7f0000002d80)=""/84, 0x54}, {&(0x7f0000002e00)=""/201, 0xc9}, {&(0x7f0000002f00)=""/36, 0x24}, {&(0x7f0000002f40)=""/108, 0x6c}, {&(0x7f0000002fc0)=""/66, 0x42}, {&(0x7f0000003040)=""/184, 0xb8}, {&(0x7f0000003100)=""/116, 0x74}], 0x8, &(0x7f0000003200)=""/29, 0x1d}, 0x4}, {{&(0x7f0000003240)=@l2, 0x80, &(0x7f00000046c0)=[{&(0x7f00000032c0)=""/249, 0xf9}, {&(0x7f00000033c0)=""/218, 0xda}, {&(0x7f00000034c0)=""/81, 0x51}, {&(0x7f0000003540)=""/4096, 0x1000}, {&(0x7f0000004540)=""/218, 0xda}, {&(0x7f0000004640)=""/112, 0x70}], 0x6, &(0x7f0000004740)=""/4096, 0x1000}, 0x1}], 0x5, 0x0, &(0x7f00000058c0)={r9, r10+30000000}) r12 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r12, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r12, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r13}) r14 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r14, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r14, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r15}) r16 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r16, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r18 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000006000)='/dev/dlm_plock\x00', 0x404000, 0x0) ioctl$sock_inet6_SIOCADDRT(r18, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x5, 0x0, 0x3f, 0x680, 0x200, 0x8534b25352800610, r17}) r19 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r19, 0x80404509, &(0x7f0000000340)=""/196) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$sock_inet6_SIOCADDRT(r19, 0x890b, &(0x7f0000000440)={@rand_addr="dd03f3df7c5e0b480cabe16235d883b2", @loopback, @empty, 0x6, 0x0, 0x3, 0x680, 0x200, 0x8534b25352800610, r20}) r21 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r21, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r21, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r22 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r21, r22, 0x0, 0xffffffff) getsockopt$inet_IP_XFRM_POLICY(r22, 0x0, 0x11, &(0x7f0000005900)={{{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000005a00)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000005fc0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000005f80)={&(0x7f0000005a40)=ANY=[@ANYBLOB="18050000", @ANYRES16=r3, @ANYBLOB="04002abd7000fedbdf250100000008000100", @ANYRES32=r5, @ANYBLOB="5001020038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000600000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004001339000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b00000008000400af00000008000600", @ANYRES32=r7, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r8, @ANYBLOB="08000700000000005c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000002c0004003f0008031f0e000003004005d5000000070007070e0e0000080005d00100000000001f3f0300000008000100", @ANYRES32=r11, @ANYBLOB="b80102004c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000001c0004000000000601000080040006056f0e0000030040050200000040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000100004006c6f616462616c616e63650038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400ff0f000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=0x0, @ANYBLOB="080007000000000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=0x0, @ANYBLOB="080007000000000038000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000080003000300000008000400ff03000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000000000008000100", @ANYRES32=r13, @ANYBLOB="e401020040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=0x0, @ANYBLOB="080007000000000038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400550c000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000900000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f6164636173740000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r15, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r17, @ANYBLOB="3c00010024000100757365725f6c696e6b7570010100000000000000000000000000fbff0000000008000300060000000400040004000000", @ANYRES32=r20, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000200000008000600", @ANYRES32=r23], 0x518}, 0x1, 0x0, 0x0, 0x20000000}, 0x40100) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000100), &(0x7f0000000180)=0xc) fadvise64(r0, 0x0, 0x0, 0x4) [ 1450.362044][T13684] attempt to access beyond end of device [ 1450.367790][T13684] loop5: rw=2049, want=145, limit=128 [ 1450.375739][T13684] attempt to access beyond end of device [ 1450.381431][T13684] loop5: rw=2049, want=2705, limit=128 [ 1450.388537][T13684] attempt to access beyond end of device [ 1450.394165][T13684] loop5: rw=2049, want=3049, limit=128 01:29:59 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) [ 1450.548191][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1450.554009][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:29:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000500"}) 01:29:59 executing program 1: perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setuid(0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/icmp\x00') readv(0xffffffffffffffff, &(0x7f0000002340)=[{&(0x7f00000001c0)=""/4096, 0x157e}], 0x1) readv(r0, &(0x7f0000000580), 0x3c1) [ 1450.638206][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1450.644015][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1450.708193][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1450.714033][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1450.719900][ C0] protocol 88fb is buggy, dev hsr_slave_0 01:29:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000600"}) 01:29:59 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) 01:29:59 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) [ 1451.425396][T13723] IPVS: ftp: loaded support on port[0] = 21 [ 1452.286602][ T27] audit: type=1800 audit(1577151001.023:90): pid=13702 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="bus" dev="sda1" ino=17778 res=0 [ 1452.494636][T13730] attempt to access beyond end of device [ 1452.504710][T13730] loop5: rw=2049, want=130, limit=128 [ 1452.512770][T13730] attempt to access beyond end of device [ 1452.524380][T13730] loop5: rw=2049, want=131, limit=128 [ 1452.533207][T13730] attempt to access beyond end of device [ 1452.544440][T13730] loop5: rw=2049, want=132, limit=128 [ 1452.552383][T13730] attempt to access beyond end of device [ 1452.563481][T13730] loop5: rw=2049, want=133, limit=128 [ 1452.571539][T13730] attempt to access beyond end of device [ 1452.577341][T13730] loop5: rw=2049, want=142, limit=128 [ 1452.607371][T13730] attempt to access beyond end of device [ 1452.632815][T13730] loop5: rw=2049, want=143, limit=128 [ 1452.654021][T13730] attempt to access beyond end of device [ 1452.678492][T13730] loop5: rw=2049, want=144, limit=128 [ 1452.684019][T13730] attempt to access beyond end of device [ 1452.704503][T13730] loop5: rw=2049, want=145, limit=128 01:30:01 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x12) 01:30:01 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:30:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x0, 0x0) close(r0) 01:30:01 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(0x0, 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:01 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0xe, &(0x7f00000005c0)="deb813cba35a9d3309316ad725d6faf0b920030668c660b069b2568304b87b8540704c371d12fd65af6b4fcf6b9bc612e01f7a4beec3209eff5c437a24a921fb55d93519657f2e60d3fbb9e25b091399b08b58837f1379f57b53cd59b1af27e1c32066105852c9cf578c38eb5759afe3783d864393d3fed3d76ee92b8a51e8630721388254def0b99526a06d4434f237deee4bef123ab7b7f6cfdf8000ea8f1d5e6a09edab8448ccd442d06a29e4d8134f9494b749054e6d9eac7e1b4c0d2f7fbb87d000bb56f62ed990af96c256ad7338f592429eece4df1fc39b12c6a1a589d5153786d05510cbceb47b6c5be749cc82d4d586d3e9bdf4af642e5481d9ab26febc28f80570f2022ddd60b9b5611046dfae42793c2addcf945eaa62fa5c2451d07626ad6183948b10812d3ffdce25163e3b8c00b5ce043010bef805c18c0679bc481d3fa34a2aa4b59cdaeb783de74e900d77428670a30ac5d18f939370e6ded1dc98fe05e352bcc4af55a7d851a18d447b85a14bdc96bfc4cab612e662d3d02484a6b7c99f7ed9616e76d9d4f28c5db57efe11a817d4a19db3224eb236af6571d99cb5a8c2d75456821adf15d51f8a27cf7126ed05be55116ee077d629731d6504c5cf0f5a8d60af66f903cd3bcf606c76503a027687683dbd74cdadba794cc99f4ce15b4087f9df2164a58f9d04122b37e47cfd0843a4122aabe1d797a4104b9d125600c2389c21fdc19d291f9d417f4277903af2eff00f033705d4dec791e9784b65856632e2972a31ecef2c045e5a51354bdaab32c84ea35d7b4dc48bf458a17f8be1f74b4d6ddfddd858c86685e085285b0475da43d7242fc19754edc507a3d81b9c24a4ad3b30a8b46a8e61a0fed4e200c56693bb6e1a33596053d6e2fe91b3a2b34841452a149922adac75b4ef9fcf957ae93e7e35a5e89b83f6ede136eb986490d678a79d56967e58c5cf5ff0c95d1cc922b852a723dbcc8f3db6e2aa8ee0ca79b6d515e1495937d1860dec5bec4859a20e2d64cf99928455b59ed781a4f9a418f3301c8edd2ab902a0f2583b148e5f1c12f87ec8bfa2658f1eba627d3424900146d417e7e295d4c5afabf4a4e0545b5c4e2fd6499f180dab589e58c9504232e73120c980be9af95b8152ff877cbbe9516a4651a5333df88d95b5d97391d805a0ea77017cca10b96296910ec92e2853759eecfbb19c335eb104ee6441097e2eccf677082138dde523a89bcd74491c14457af3390be693a3118ee031162581438459f1a43d9c593028856a151e8b916871b779520422195aaeb42631fc0cdf72dfa58df31a0f9061d86a457deeae2d1ed434e03e792ce929ef3ea4a03c89c862ff1bde7d02fdcbb41d31cbfb5d2f2f2ba60f7699e0985c409aa556327001a412f921e78fd245736776e113535680b6a1bced94cdd0b12bddefb1056332d7ca3722f3674f00e39fb73baea8e232ee5a1295bf9ce686c75a6bfe39cd11f86ab064b6e9afdf3d42a3e6487ab80bcf198a44a96e995d86f58b48b4d5ce1b9fd45e162ad96326730ad8cc9591a7e011580dd60ee38f892c28ace75007a6ddacdc852815ad3b0df8723a5d7e4f466ea6b899b820bbe6860c583db1c3ea3a8445c0afa17b775c8a633dd282cf15ed3a834c705cefb62140479b17a6f5b47ac2b79e167260bd04e732e1fb7223153906b62568e3e8bae865174ad028b5c5304c21c6c9ca4279e21c6e21e154b850dfa3741e898dc993d74d9736572b08f413c98d11d2e374e854a0ae79ba09ec0f5945d140961ffb37a01d34bbe0f75d63c2493eeee4477735943223662f83a2bf11f52d8ff49359db460f73dbb02ef4f291537013b9d3c96bd57d2fdfff2cf10b2629fd41c45373e34e7e79cfc6f89ce7523ab0c9bea337d98b283bb1af8ee8a62e09302d337a2823572ce5156f68eb50f4241536e80e1ce2fb766cc1fd7297fbfb4bbe0138e177458484ad117fe6b61da810bee9eb80e941856644a652993315eac10101aa010bc1c902bea1365f1785ef60cb5b52104667b89e0b57547a3d87c243f1dff18c114cb8b6836640ac7711797a10345434d95fc2099ef52ff3d05093a5963edb0f4436b2ed0201c4f2e29882f6c8f6610ee6ba3714eaf1677fb1720931541e79449aed3a58c3c7d469bd12405652b0b376c4892aba2cc41cb862a3e1b0f86c0cb87b58730e5e0d901fc246604d7ef6f2f3ae3858480c3e8fcd5fbfedef83a03f60e33f04b5158b1f99d2483e962aa253bd755a7221c4ed363dd9af3ba8ba666a7b90cca65bda668e9e3fed0a60e1fb64566d8f72570f84ccab17943227136f487ecdb8c8813dc72cfbab650cf4b56e66eecb2725c1c750f7c8616f287729492d94ef839f0b5cd0ef076e023189955f17d4da6ee73c0c966ecbf1be6500b9d83160f4d5f1e4c7b73fa582e4646f20760707394c5ab028bec3befcbd802033aaed74f0bfe6ce62dba6f2de0bd5d86545df5686a1c1162bd4839407cfd20542385251c508fb7faf01985c332b35c0d06b91d9019fd56c3abe3af77ef719f77cbb949b30acef4204fdedd27e93ef0377c1374e325e75e22f3f61486fa1e9d56b0883bb868686f07f636997c173897b005683b34937e0b22ed0950ca92c8e0fd6c1c14ff41577a6dca5e494a09cf979969eade2b125fecac109ea315e50e338efd58ebe31b39fe633bfb3c19da9e7a33acd4311e9a336f8613cf41e07d18e0a367ac2d9d119a59f918e4993afb3a9d841e8ed656e7aabdabc0b5ed7ae9c0b62b7c9da40f8319acc517cff591ce5e37a36a1e74e42f04b5da5c429d7a17d2f227058577f4cbed007c1a8a479dca4cd3f0a1e2bd6b675262b75b575da08c9ccd7da1046eb1750a37fb861349b19f7309e61944999b87da706d6047cd6e3f66f269fc1f7a326b95559d37a6bb109f8722a2cd0f06dfbf2b68d3734f1bd231138854153d07c85e54c78e4f43244e0f298b1cbcd166a75be9a70e1e6e21a0acba5de997a9a1ea18490a37a0239531fea82e0c0893786d91fd0a46bf95d4637824cf1e6a257293b25335dd75229ad77be9d622ee2c83df78afcab24c38d13808b986b447a2e2750ee584c8481d6c6664568b9ad8a373734443a6a8cc7cb2342ea5b633fac647e3114d685414aaa9ec5b8fdec5d1c2047d06b89aa511d2716ed4f0df6ea7f20b5070b728925d1c0d53dae72e591d64623a672809858b97005e8041cf78938b31a5a568183fc64bde3dc39536237f2e5215aff8cb015262d255a7ff7e97793f43d6ea9616ebe16a9feba48658f9ca7c831ef806a7e179639676f8918a5d41945e02de1c11969de26d0c9f9ea9ecb20a9571d46fb774c68883a14b3f7daea1e1edb73713d4a727a4216463f8c75492b539bbd77f1ca62b4fab74a39e1fe9c55256832c862d5a259cbdcda2685c4b31df18987b107639d399a984f6193096ab29d4fc37e7a7b0e8e5b4f860a0699c1c72e775e30a1871c198e7ff3f5553f7a6eda2c4caceb170f715b6cbf3c64f101ec8f15a430df978f2c7c08efa8f1edc2ebdb51fb6f51bd6a05dec4c0d5f248c42e9009583d04d3c61af0c7a7ccb8a85f53af183d4c111126a14c1fb891dd5de0769d219505303d8e5a3c6b80e89b0a2c1132dd53f5ccdd2c157f4a0b3dfa2e8b5ee1372dba070632e8ed4a7ce96ad5e7f42615f0c0872b26bc0f150c3cc823c4fff0fb56540d36cfdeb92e9996d0c4af120cc1a7c1c5b3d98003a2314551596e33b7d7581a78134eef50260cb5652c3741cf7a5513d0c445ce6603afbc630ece8cc3205ae9569a099316eeee12acc6178399766ed329eb57cf7e7a8be7135fd7811d130e5dee5b62f1a9651b2ce89f135be5d0fbefd41b8a556cae6975d616c8b2f4b34c1d5056106db793ee0c2d4a945816ca3ad88db7eab8daf4c78d0a1fcf8b28d2dbf81b7680f7185f4f584037c2f255e1f7b18a88559ce1570d10856533968ae45c78b69dd9f1c48f0914f41c0944f5cf366b8b728839f901247dd5f9264c580349dca01dfb532c6d991834e5adab14e8439f442cd8f2be2af8eecffbac2e17cd877059dfe596c1f7192834525b781a4a51d7d8099a8cc19568edf907b7943366c03371dbd907a65d21282fc8ec63712680ba88362af8ed0a6e714402d3ff73befabf91e75a7e35d58dc8623828146cf1021b03bf792f63e0e7d9b178e7c0dbb7bd6a4b7554e009922d82c1fe7df65c90844ba861d6a507efa5a7a232cb67f7a347ecba37d0840db7e74b74726bee1a277caef2f2afdb4992ba74d0e06886e29d7b423b2af0845129555b9675d16cdbec5056742904dc479f6955f202fef069b4129938a7a1e31cd44c634f00d40dc3d790478fc60e355d83cb6e05f608985a99ff15031b9e0442e8aa156a97e4019e54739a9a0a22da18ec428c60f8133eb56c2647730a46c9ba66f7b1972e4e5c46541998827f8131b67a89f68615c9f89aaf5082146664d6f7427d04f72518e972865c8d119ef05951b19b1c57ba27cd9b9ee087c1ba1f17436af4d9472cf6fa14637f81ebb8a36993421255eb2738190fc2450f52d29d325efd76b89e608af3828379821e24f657823ad77fdc303135cdb5aafc5ff65026cb14a50bd3d9739ae14cb617b0ff053788bd744b5a43fe2e0e7511d348fb86c6ca38a4673ae76402fd5171a52d93fa6effdc1169ba6df6ef7fe94a3fb1d61bad4262cb52f5065de4c064a4e7b5c3fd0e92864a227918b3c9c10ff4e09e9f33c6c84c8ff9b89a4e1f6394718dccedd478f80975b5353a220dd47a4c8e101a023b39674483c322ea691fad1db0cfc9a72820c7767c17cac5d940a2ccd0365c7145c0c08e7e139059bec8d01adcf59da05dd81bc052fd1e7271edbb63fcaa0cf21cc6eac9cf0104663bb6de3e24b499addd423b59c3d4f45a0ec89cd4d961d04f6561ad6a47a747a05264619a1d18ec5e5fc7c7ea6fbf55f5be5a43b7ea5df72c9cb5a4630647c894a25b4d70323389ef3e313a86ea0da7d8e659db0b48ff0a7d3b0d1585d78482576b1f10911492c22beaa7b11156df22a83fbababbbd1a827303012d5fd3683863537f0434f2a0877b239de70a6d84c16d548707515e1e85470ac579d2bf95e406cef13dbee6d34e7b7d5882c060d9212131bcdfd6adb8bd7126a24e650c2a07a6fdfa24d0c0b815f749daa3bd3785c113541e3246565771adc4fc6c2ac57decd888b1d0ea5c964591cfc98c2e94741b28b358c8e61df893a2e24583312beae21f11c56055fd06cde60a0809772ac715421ba7dc25b22ffb62674339edf0f22350a163e1355758e20105dfeba4f15c703f3a01b4e4ae847cc355a245cbe294d83f6745b7d0c8894e517d4e50c0bac16f962f413cd531ed52a132a82513ce1604a2ed4ad95df600a274117d206b71febc9c672e651fe3e630f489e71d6aafb76a162bc3333dd9e211d9f63ed8ac3c03996e30092a0094e9f1ae473742f2de46f85b4fa03d1e025d23bdd0c73ac52c0293131443021007e2591545b5fde9fb473e231e822e840440b22c7003b3b8207921f626e644648296d3c339aca5f5b23de3a6d3b8c21afb19557f3f4a468fa4de30b69998a5b189fcc90c5a1b5985e72ec33a8c48ca55b30acc0c9becbb3866650cf0f48b11ef6618090820724d8d3a4db27e62c8c58df57bd623832fb9b605bbb8fd914330b26cb3c928c2c66e69b781b62f080b1c91d94c24d99c716297c900074a2c22a8b37bd57b6b1868181fc1bf27aa4d0d806089ca9a30e36d02e9e8c271", 0x1000) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r1, 0x0, 0x0, 0x4) 01:30:01 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) [ 1452.733333][T13730] attempt to access beyond end of device [ 1452.740599][T13730] loop5: rw=2049, want=7153, limit=128 [ 1452.755805][T13730] attempt to access beyond end of device [ 1452.762202][T13730] loop5: rw=2049, want=10489, limit=128 01:30:01 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1452.848236][ T307] tipc: TX() has been purged, node left! [ 1452.949204][T13760] attempt to access beyond end of device 01:30:01 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1453.028017][T13760] loop0: rw=1, want=130, limit=128 [ 1453.080272][T13760] attempt to access beyond end of device [ 1453.109570][T13760] loop0: rw=1, want=131, limit=128 01:30:01 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) [ 1453.149442][T13760] attempt to access beyond end of device [ 1453.187332][T13760] loop0: rw=1, want=132, limit=128 [ 1453.224693][T13760] attempt to access beyond end of device [ 1453.334899][T13760] loop0: rw=1, want=133, limit=128 01:30:02 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1453.370679][T13760] attempt to access beyond end of device [ 1453.394033][T13760] loop0: rw=1, want=142, limit=128 [ 1453.413163][T13760] attempt to access beyond end of device [ 1453.435054][T13760] loop0: rw=1, want=143, limit=128 [ 1453.475773][T13760] attempt to access beyond end of device [ 1453.514368][T13760] loop0: rw=1, want=144, limit=128 01:30:02 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) [ 1453.553095][T13760] attempt to access beyond end of device [ 1453.589614][T13760] loop0: rw=1, want=145, limit=128 01:30:02 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) [ 1453.741350][T13760] attempt to access beyond end of device [ 1453.771558][T13760] loop0: rw=1, want=4489, limit=128 [ 1453.816538][T13751] attempt to access beyond end of device [ 1453.849028][T13751] loop0: rw=2049, want=6545, limit=128 [ 1453.870338][T13760] attempt to access beyond end of device [ 1453.896505][T13760] loop0: rw=1, want=4497, limit=128 [ 1453.937336][T13751] attempt to access beyond end of device [ 1453.945597][T13751] loop0: rw=2049, want=8329, limit=128 [ 1453.989739][T13760] attempt to access beyond end of device [ 1453.995424][T13760] loop0: rw=1, want=8961, limit=128 [ 1454.032163][T13760] attempt to access beyond end of device [ 1454.062686][T13751] attempt to access beyond end of device [ 1454.068238][T13760] loop0: rw=1, want=9921, limit=128 [ 1454.076285][T13751] loop0: rw=2049, want=9681, limit=128 [ 1454.123629][T13769] attempt to access beyond end of device [ 1454.131741][T13769] loop5: rw=2049, want=130, limit=128 [ 1454.137280][T13769] buffer_io_error: 30 callbacks suppressed [ 1454.137291][T13769] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1454.159446][T13769] attempt to access beyond end of device [ 1454.165185][T13769] loop5: rw=2049, want=131, limit=128 [ 1454.174780][T13769] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1454.184130][T13769] attempt to access beyond end of device [ 1454.194784][T13769] loop5: rw=2049, want=132, limit=128 [ 1454.201267][T13769] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1454.214823][T13769] attempt to access beyond end of device [ 1454.221582][T13769] loop5: rw=2049, want=133, limit=128 [ 1454.227033][T13769] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1454.241979][T13769] attempt to access beyond end of device [ 1454.247642][T13769] loop5: rw=2049, want=142, limit=128 [ 1454.255116][T13769] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1454.266661][T13769] attempt to access beyond end of device [ 1454.273688][T13769] loop5: rw=2049, want=143, limit=128 [ 1454.281627][T13769] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1454.291484][T13769] attempt to access beyond end of device [ 1454.297106][T13769] loop5: rw=2049, want=144, limit=128 [ 1454.305736][T13769] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1454.315680][T13769] attempt to access beyond end of device [ 1454.323872][T13769] loop5: rw=2049, want=145, limit=128 [ 1454.330577][T13769] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1454.343649][T13769] attempt to access beyond end of device [ 1454.350618][T13769] loop5: rw=2049, want=2233, limit=128 [ 1454.362407][T13769] attempt to access beyond end of device [ 1454.368403][T13769] loop5: rw=2049, want=5521, limit=128 01:30:03 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x38) 01:30:03 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:03 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000fffffdfd00"}) 01:30:03 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4$llc(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(0xffffffffffffffff) 01:30:03 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) recvmsg$can_bcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)=""/202, 0xca}], 0x1}, 0x10023) fadvise64(r0, 0x0, 0x0, 0x4) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000040)={0x5000}) [ 1454.377533][T13769] attempt to access beyond end of device [ 1454.383959][T13769] loop5: rw=2049, want=8017, limit=128 [ 1454.766295][T13818] attempt to access beyond end of device [ 1454.788192][ C0] net_ratelimit: 19 callbacks suppressed [ 1454.788200][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1454.799754][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1454.844567][T13818] loop0: rw=1, want=130, limit=128 [ 1454.865814][T13818] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1454.878253][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1454.883803][T13818] attempt to access beyond end of device [ 1454.884078][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1454.895497][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1454.896781][T13818] loop0: rw=1, want=131, limit=128 [ 1454.901309][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1454.937200][T13818] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1454.964773][T13818] attempt to access beyond end of device [ 1454.983743][T13818] loop0: rw=1, want=132, limit=128 [ 1455.002524][T13818] attempt to access beyond end of device [ 1455.018807][T13818] loop0: rw=1, want=133, limit=128 [ 1455.030732][T13818] attempt to access beyond end of device [ 1455.046776][T13818] loop0: rw=1, want=142, limit=128 [ 1455.061233][T13818] attempt to access beyond end of device [ 1455.077275][T13818] loop0: rw=1, want=143, limit=128 [ 1455.091700][T13818] attempt to access beyond end of device [ 1455.099699][T13818] loop0: rw=1, want=144, limit=128 [ 1455.116952][T13818] attempt to access beyond end of device [ 1455.135857][T13818] loop0: rw=1, want=145, limit=128 [ 1455.164977][T13818] attempt to access beyond end of device [ 1455.183678][T13818] loop0: rw=1, want=2929, limit=128 [ 1455.211185][T13818] attempt to access beyond end of device [ 1455.242204][T13818] loop0: rw=1, want=5065, limit=128 [ 1455.285371][T13818] attempt to access beyond end of device [ 1455.329467][T13818] loop0: rw=1, want=7113, limit=128 [ 1455.384733][T13818] attempt to access beyond end of device [ 1455.425644][T13818] loop0: rw=1, want=12369, limit=128 [ 1455.459391][T13806] attempt to access beyond end of device [ 1455.465072][T13806] loop0: rw=2049, want=13121, limit=128 [ 1455.494597][T13818] attempt to access beyond end of device [ 1455.517691][T13818] loop0: rw=1, want=12377, limit=128 [ 1455.537847][T13812] attempt to access beyond end of device [ 1455.558194][T13812] loop5: rw=2049, want=130, limit=128 [ 1455.563654][T13812] attempt to access beyond end of device [ 1455.602091][T13812] loop5: rw=2049, want=131, limit=128 [ 1455.607553][T13812] attempt to access beyond end of device [ 1455.628159][T13812] loop5: rw=2049, want=132, limit=128 [ 1455.633729][T13812] attempt to access beyond end of device [ 1455.645150][T13812] loop5: rw=2049, want=133, limit=128 [ 1455.657415][T13812] attempt to access beyond end of device [ 1455.668847][T13812] loop5: rw=2049, want=142, limit=128 [ 1455.681369][T13812] attempt to access beyond end of device [ 1455.693080][T13812] loop5: rw=2049, want=143, limit=128 [ 1455.705401][T13812] attempt to access beyond end of device [ 1455.718932][T13812] loop5: rw=2049, want=144, limit=128 [ 1455.732192][T13812] attempt to access beyond end of device [ 1455.746783][T13812] loop5: rw=2049, want=145, limit=128 [ 1455.769983][T13812] attempt to access beyond end of device [ 1455.788130][T13812] loop5: rw=2049, want=2201, limit=128 [ 1455.796617][T13812] attempt to access beyond end of device [ 1455.810045][T13812] loop5: rw=2049, want=4441, limit=128 [ 1455.845355][T13812] attempt to access beyond end of device [ 1455.855718][T13812] loop5: rw=2049, want=9561, limit=128 [ 1455.883895][T13812] attempt to access beyond end of device [ 1455.894145][T13812] loop5: rw=2049, want=14433, limit=128 [ 1455.988165][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1455.988197][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1455.993948][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1456.788229][ C1] protocol 88fb is buggy, dev hsr_slave_0 01:30:05 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000ff00"}) 01:30:05 executing program 4: mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, r0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000003a40)={0xa, 0x0, 0x0, @remote}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0xbb8) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000001c80)) getuid() io_setup(0x0, 0x0) socket(0x11, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) bind$packet(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$tipc(0x0) 01:30:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:05 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) clock_gettime(0x1, &(0x7f0000000400)={0x0, 0x0}) ioctl$VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000440)={0x54c, 0x1, 0x4, 0x80000000, 0x3, {r1, r2/1000+10000}, {0x1, 0x8, 0x0, 0x3e, 0x8, 0x5, "7f34f193"}, 0x3, 0x2, @userptr=0x200, 0x9, 0x0, 0xffffffffffffffff}) ioctl$SIOCRSGCAUSE(r3, 0x89e0, &(0x7f00000004c0)) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:05 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x3d) 01:30:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000fdfdffff00"}) 01:30:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000100"}) 01:30:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000800100"}) 01:30:05 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000200"}) [ 1457.162163][T13902] attempt to access beyond end of device [ 1457.183981][T13902] loop0: rw=1, want=130, limit=128 [ 1457.197159][T13902] attempt to access beyond end of device 01:30:06 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000300"}) [ 1457.221844][T13902] loop0: rw=1, want=131, limit=128 [ 1457.238062][T13902] attempt to access beyond end of device [ 1457.257538][T13902] loop0: rw=1, want=132, limit=128 [ 1457.287528][T13902] attempt to access beyond end of device [ 1457.341829][T13902] loop0: rw=1, want=133, limit=128 01:30:06 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1457.369738][T13902] attempt to access beyond end of device [ 1457.470749][T13902] loop0: rw=1, want=142, limit=128 [ 1457.505815][T13845] IPVS: ftp: loaded support on port[0] = 21 [ 1457.510338][T13902] attempt to access beyond end of device [ 1457.539460][T13902] loop0: rw=1, want=143, limit=128 [ 1457.561844][T13902] attempt to access beyond end of device [ 1457.582821][T13902] loop0: rw=1, want=144, limit=128 [ 1457.619309][T13902] attempt to access beyond end of device [ 1457.655713][T13902] loop0: rw=1, want=145, limit=128 [ 1457.816195][T13902] attempt to access beyond end of device [ 1457.836477][T13837] attempt to access beyond end of device [ 1457.852151][T13902] loop0: rw=1, want=2321, limit=128 [ 1457.857459][T13837] loop5: rw=2049, want=130, limit=128 [ 1457.865656][T13837] attempt to access beyond end of device [ 1457.874918][T13902] attempt to access beyond end of device [ 1457.883470][T13837] loop5: rw=2049, want=131, limit=128 [ 1457.889808][T13837] attempt to access beyond end of device [ 1457.896996][T13902] loop0: rw=1, want=3369, limit=128 [ 1457.902759][T13837] loop5: rw=2049, want=132, limit=128 [ 1457.914907][T13839] attempt to access beyond end of device [ 1457.920998][T13837] attempt to access beyond end of device [ 1457.927964][T13839] loop0: rw=2049, want=3377, limit=128 [ 1457.940621][T13837] loop5: rw=2049, want=133, limit=128 [ 1457.955880][T13837] attempt to access beyond end of device [ 1457.972541][T13837] loop5: rw=2049, want=142, limit=128 [ 1457.992866][T13837] attempt to access beyond end of device [ 1458.007680][T13837] loop5: rw=2049, want=143, limit=128 [ 1458.024807][T13837] attempt to access beyond end of device [ 1458.044111][T13837] loop5: rw=2049, want=144, limit=128 [ 1458.061432][T13837] attempt to access beyond end of device [ 1458.081500][T13837] loop5: rw=2049, want=145, limit=128 [ 1458.106698][T13837] attempt to access beyond end of device [ 1458.116613][T13837] loop5: rw=2049, want=2913, limit=128 [ 1458.135550][T13837] attempt to access beyond end of device [ 1458.162673][T13837] loop5: rw=2049, want=4961, limit=128 [ 1458.177419][T13837] attempt to access beyond end of device [ 1458.186131][T13837] loop5: rw=2049, want=6249, limit=128 01:30:07 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:07 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000400"}) 01:30:07 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:07 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:07 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xcb7bd02d8cccc9f6) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:07 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x3e) 01:30:07 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:07 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000500"}) [ 1458.948323][ T307] tipc: TX() has been purged, node left! 01:30:07 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:07 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000600"}) 01:30:08 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:08 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) [ 1459.682973][T13986] attempt to access beyond end of device [ 1459.703711][T13986] loop5: rw=2049, want=130, limit=128 [ 1459.718302][T13986] buffer_io_error: 30 callbacks suppressed [ 1459.718312][T13986] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1459.768584][T13986] attempt to access beyond end of device [ 1459.774761][T13986] loop5: rw=2049, want=131, limit=128 [ 1459.787087][T13986] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1459.817425][T13986] attempt to access beyond end of device [ 1459.824840][T13986] loop5: rw=2049, want=132, limit=128 [ 1459.840784][T13986] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1459.849510][T13986] attempt to access beyond end of device [ 1459.855237][T13986] loop5: rw=2049, want=133, limit=128 [ 1459.861584][T13986] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1459.873222][T13986] attempt to access beyond end of device [ 1459.878987][T13986] loop5: rw=2049, want=142, limit=128 [ 1459.884568][T13986] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1459.893195][T13986] attempt to access beyond end of device [ 1459.898956][T13986] loop5: rw=2049, want=143, limit=128 [ 1459.904532][T13986] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1459.913254][T13986] attempt to access beyond end of device [ 1459.919458][T13986] loop5: rw=2049, want=144, limit=128 [ 1459.924850][T13986] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1459.933445][T13986] attempt to access beyond end of device [ 1459.939295][T13986] loop5: rw=2049, want=145, limit=128 [ 1459.944665][T13986] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1459.955993][T13986] attempt to access beyond end of device [ 1459.961728][T13986] loop5: rw=2049, want=2193, limit=128 [ 1459.973588][T13986] attempt to access beyond end of device [ 1459.979602][T13986] loop5: rw=2049, want=5473, limit=128 [ 1459.990121][T13986] attempt to access beyond end of device [ 1459.995786][T13986] loop5: rw=2049, want=7089, limit=128 [ 1460.148175][ C1] net_ratelimit: 19 callbacks suppressed [ 1460.148183][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1460.148218][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1460.153876][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1460.159610][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1460.948200][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1460.954047][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1461.028190][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1461.034080][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1461.118248][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1461.118304][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:30:10 executing program 1: openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000140), 0x10) setsockopt(r0, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r0) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) 01:30:10 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) 01:30:10 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:10 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:10 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000200)={'syz'}, &(0x7f0000000380)='X', 0x1, r1) r3 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000040)='asymmetric\x00', &(0x7f0000000400)=@chain={'key_or_keyring:', 0x0, ':chain\x00'}) keyctl$KEYCTL_MOVE(0x1e, r2, r1, r3, 0x0) r4 = add_key(&(0x7f0000000280)='blacklist\x00', &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, r3) request_key(&(0x7f00000001c0)='ceph\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000240)='\x00', r4) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r5 = geteuid() quotactl(0x100000000, &(0x7f0000000080)='./file0\x00', r5, &(0x7f00000000c0)="9bc67e0653aa4a86be0ad805958b4304270c298f88a285c181ecdbea50be0f064bc22e9844b8fdd3bd972bda62760c33341b41111617ceb160a9f4064a9f8abac70e7e9f2aaf20f6b85a2ea313955a72cffad86af90c7e5c3e31277f7e4808b89cf942") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ocfs2_control\x00', 0xc77544c4869d5623, 0x0) write$eventfd(r6, &(0x7f0000000040)=0x4, 0x8) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:10 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x1cf) 01:30:11 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:30:11 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:11 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) 01:30:11 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1462.693410][T14048] IPVS: ftp: loaded support on port[0] = 21 01:30:11 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:30:11 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1463.173304][T14031] attempt to access beyond end of device [ 1463.242268][T14031] loop5: rw=2049, want=130, limit=128 [ 1463.282566][T14031] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1463.341234][T14031] attempt to access beyond end of device [ 1463.381611][T14031] loop5: rw=2049, want=131, limit=128 [ 1463.416703][T14031] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1463.485836][T14031] attempt to access beyond end of device [ 1463.494833][T14031] loop5: rw=2049, want=132, limit=128 [ 1463.512916][T14031] attempt to access beyond end of device [ 1463.526908][T14031] loop5: rw=2049, want=133, limit=128 [ 1463.532549][T14031] attempt to access beyond end of device [ 1463.544762][T14031] loop5: rw=2049, want=142, limit=128 [ 1463.550740][T14031] attempt to access beyond end of device [ 1463.556511][T14031] loop5: rw=2049, want=143, limit=128 [ 1463.595177][T14031] attempt to access beyond end of device [ 1463.622054][T14031] loop5: rw=2049, want=144, limit=128 [ 1463.647132][T14031] attempt to access beyond end of device [ 1463.685625][T14031] loop5: rw=2049, want=145, limit=128 [ 1463.701238][T14031] attempt to access beyond end of device [ 1463.706972][T14031] loop5: rw=2049, want=2201, limit=128 [ 1463.724538][T14031] attempt to access beyond end of device [ 1463.735903][T14031] loop5: rw=2049, want=4249, limit=128 [ 1463.755911][T14031] attempt to access beyond end of device [ 1463.762717][T14031] loop5: rw=2049, want=6185, limit=128 01:30:12 executing program 1: openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000140), 0x10) setsockopt(r0, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r0) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) 01:30:12 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:12 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000fffffdfd00"}) 01:30:12 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:12 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000080)) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x8, @mcast1, 0x4}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) getsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000100), &(0x7f00000001c0)=0xe) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r4, 0x0, 0xffffffff) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf361, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, r4, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:12 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x3800) 01:30:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000000000ff00"}) 01:30:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000ffffffff00"}) 01:30:13 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1464.528349][ T265] tipc: TX() has been purged, node left! 01:30:13 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000200"}) 01:30:13 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:13 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x7}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) [ 1465.083161][T14272] attempt to access beyond end of device [ 1465.093595][T14272] loop0: rw=1, want=130, limit=128 [ 1465.106073][T14272] buffer_io_error: 6 callbacks suppressed [ 1465.106085][T14272] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1465.139827][T14272] attempt to access beyond end of device [ 1465.159169][T14272] loop0: rw=1, want=131, limit=128 [ 1465.180408][T14272] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1465.188172][ C0] net_ratelimit: 19 callbacks suppressed [ 1465.188180][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1465.200410][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1465.200921][T14272] attempt to access beyond end of device [ 1465.213768][T14272] loop0: rw=1, want=132, limit=128 [ 1465.226512][T14272] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1465.236843][T14272] attempt to access beyond end of device [ 1465.245254][T14272] loop0: rw=1, want=133, limit=128 [ 1465.268204][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1465.274007][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1465.279883][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1465.285658][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1465.291068][T14272] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1465.336768][T14272] attempt to access beyond end of device [ 1465.349345][T14272] loop0: rw=1, want=142, limit=128 [ 1465.360161][T14272] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1465.377828][T14272] attempt to access beyond end of device [ 1465.389444][T14272] loop0: rw=1, want=143, limit=128 [ 1465.400761][T14272] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1465.438183][T14272] attempt to access beyond end of device [ 1465.443861][T14272] loop0: rw=1, want=144, limit=128 [ 1465.461808][T14272] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1465.470800][T14272] attempt to access beyond end of device [ 1465.476540][T14272] loop0: rw=1, want=145, limit=128 [ 1465.492556][T14272] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1465.513299][T14272] attempt to access beyond end of device [ 1465.524431][T14272] loop0: rw=1, want=2665, limit=128 [ 1465.537304][T14272] attempt to access beyond end of device [ 1465.550534][T14272] loop0: rw=1, want=4713, limit=128 [ 1465.565945][T14272] attempt to access beyond end of device [ 1465.573894][T14272] loop0: rw=1, want=6761, limit=128 [ 1465.591409][T14272] attempt to access beyond end of device [ 1465.597147][T14272] loop0: rw=1, want=8809, limit=128 [ 1465.614344][T14272] attempt to access beyond end of device [ 1465.625798][T14272] loop0: rw=1, want=10753, limit=128 [ 1465.783720][T14266] attempt to access beyond end of device [ 1465.791221][T14266] loop0: rw=2049, want=13857, limit=128 [ 1465.801256][T14266] attempt to access beyond end of device [ 1465.806904][T14266] loop0: rw=2049, want=15217, limit=128 [ 1466.388188][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1466.388193][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1466.388245][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1466.393976][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:30:16 executing program 1: openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r0, &(0x7f0000000140), 0x10) setsockopt(r0, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r0) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) 01:30:16 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000300"}) 01:30:16 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:16 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x3e00) 01:30:16 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./bus\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:16 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000400"}) 01:30:16 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1468.145456][T14302] attempt to access beyond end of device [ 1468.158876][T14302] loop0: rw=1, want=130, limit=128 [ 1468.172711][T14302] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1468.192870][T14302] attempt to access beyond end of device [ 1468.206227][T14302] loop0: rw=1, want=131, limit=128 [ 1468.219988][T14302] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1468.239966][T14302] attempt to access beyond end of device [ 1468.253157][T14302] loop0: rw=1, want=132, limit=128 [ 1468.265976][T14302] attempt to access beyond end of device [ 1468.279390][T14302] loop0: rw=1, want=133, limit=128 [ 1468.292168][T14302] attempt to access beyond end of device [ 1468.306414][T14302] loop0: rw=1, want=142, limit=128 [ 1468.319566][T14302] attempt to access beyond end of device [ 1468.333783][T14302] loop0: rw=1, want=143, limit=128 [ 1468.365262][T14302] attempt to access beyond end of device [ 1468.404716][T14296] IPVS: ftp: loaded support on port[0] = 21 01:30:17 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1468.407582][T14302] loop0: rw=1, want=144, limit=128 [ 1468.474721][T14302] attempt to access beyond end of device [ 1468.504095][T14302] loop0: rw=1, want=145, limit=128 01:30:17 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000500"}) 01:30:17 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1468.780042][T14302] attempt to access beyond end of device [ 1468.812298][T14302] loop0: rw=1, want=2193, limit=128 [ 1468.869013][T14289] attempt to access beyond end of device [ 1468.906245][T14289] loop5: rw=2049, want=130, limit=128 [ 1468.939182][T14289] attempt to access beyond end of device [ 1468.944932][T14289] loop5: rw=2049, want=131, limit=128 [ 1468.955074][T14290] attempt to access beyond end of device [ 1468.998536][T14289] attempt to access beyond end of device [ 1469.022605][T14289] loop5: rw=2049, want=132, limit=128 [ 1469.047085][T14290] loop0: rw=2049, want=4409, limit=128 [ 1469.057468][T14302] attempt to access beyond end of device [ 1469.058956][T14289] attempt to access beyond end of device [ 1469.069147][T14302] loop0: rw=1, want=2361, limit=128 [ 1469.074789][T14290] attempt to access beyond end of device [ 1469.113900][T14289] loop5: rw=2049, want=133, limit=128 [ 1469.118660][T14290] loop0: rw=2049, want=4417, limit=128 [ 1469.125517][T14302] attempt to access beyond end of device [ 1469.137366][T14289] attempt to access beyond end of device [ 1469.138012][T14302] loop0: rw=1, want=4425, limit=128 [ 1469.150494][T14290] attempt to access beyond end of device [ 1469.156384][T14290] loop0: rw=2049, want=4433, limit=128 [ 1469.162567][T14302] attempt to access beyond end of device [ 1469.168807][T14302] loop0: rw=1, want=4441, limit=128 [ 1469.174339][T14290] attempt to access beyond end of device [ 1469.189207][T14290] loop0: rw=2049, want=4449, limit=128 [ 1469.194131][T14289] loop5: rw=2049, want=142, limit=128 [ 1469.195027][T14302] attempt to access beyond end of device [ 1469.206319][T14302] loop0: rw=1, want=4457, limit=128 [ 1469.219246][T14289] attempt to access beyond end of device [ 1469.220681][T14290] attempt to access beyond end of device [ 1469.224902][T14289] loop5: rw=2049, want=143, limit=128 [ 1469.224953][T14289] attempt to access beyond end of device [ 1469.224965][T14289] loop5: rw=2049, want=144, limit=128 [ 1469.224998][T14289] attempt to access beyond end of device [ 1469.236600][T14290] loop0: rw=2049, want=4465, limit=128 [ 1469.249132][T14302] attempt to access beyond end of device [ 1469.264976][T14302] loop0: rw=1, want=4473, limit=128 [ 1469.270787][T14290] attempt to access beyond end of device [ 1469.276838][T14290] loop0: rw=2049, want=4481, limit=128 [ 1469.289750][T14302] attempt to access beyond end of device [ 1469.295615][T14302] loop0: rw=1, want=4489, limit=128 [ 1469.301089][T14289] loop5: rw=2049, want=145, limit=128 [ 1469.306662][T14290] attempt to access beyond end of device [ 1469.309710][T14289] attempt to access beyond end of device [ 1469.314095][T14290] loop0: rw=2049, want=4497, limit=128 [ 1469.317925][T14289] loop5: rw=2049, want=2193, limit=128 [ 1469.329522][T14302] attempt to access beyond end of device [ 1469.334468][T14289] attempt to access beyond end of device [ 1469.335380][T14302] loop0: rw=1, want=4505, limit=128 [ 1469.355575][T14290] attempt to access beyond end of device [ 1469.358319][T14289] loop5: rw=2049, want=4929, limit=128 [ 1469.364933][T14290] loop0: rw=2049, want=4513, limit=128 [ 1469.377073][T14302] attempt to access beyond end of device [ 1469.385781][T14302] loop0: rw=1, want=4521, limit=128 [ 1469.396913][T14290] attempt to access beyond end of device [ 1469.403673][T14289] attempt to access beyond end of device [ 1469.414956][T14290] loop0: rw=2049, want=4529, limit=128 [ 1469.427721][T14302] attempt to access beyond end of device [ 1469.428242][T14289] loop5: rw=2049, want=5673, limit=128 [ 1469.437226][T14302] loop0: rw=1, want=4785, limit=128 [ 1469.454528][T14290] attempt to access beyond end of device [ 1469.464817][T14290] loop0: rw=2049, want=4793, limit=128 [ 1469.474568][T14302] attempt to access beyond end of device [ 1469.484270][T14302] loop0: rw=1, want=4801, limit=128 [ 1469.494458][T14290] attempt to access beyond end of device [ 1469.504142][T14290] loop0: rw=2049, want=4809, limit=128 [ 1469.520161][T14302] attempt to access beyond end of device [ 1469.536081][T14302] loop0: rw=1, want=4817, limit=128 [ 1469.546369][T14290] attempt to access beyond end of device [ 1469.562997][T14290] loop0: rw=2049, want=4825, limit=128 [ 1469.577818][T14302] attempt to access beyond end of device [ 1469.597086][T14302] loop0: rw=1, want=4833, limit=128 [ 1469.617077][T14290] attempt to access beyond end of device [ 1469.629151][T14290] loop0: rw=2049, want=4841, limit=128 [ 1469.634855][T14302] attempt to access beyond end of device [ 1469.667853][T14302] loop0: rw=1, want=4849, limit=128 [ 1469.694982][T14290] attempt to access beyond end of device [ 1469.706620][T14290] loop0: rw=2049, want=4857, limit=128 [ 1469.714610][T14302] attempt to access beyond end of device [ 1469.764917][T14302] loop0: rw=1, want=4865, limit=128 [ 1469.788410][T14290] attempt to access beyond end of device [ 1469.824456][T14290] loop0: rw=2049, want=4969, limit=128 01:30:18 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:18 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000600"}) 01:30:18 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:18 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0xffffffffffffffff) 01:30:18 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1469.872405][T14290] attempt to access beyond end of device [ 1469.895553][T14302] attempt to access beyond end of device [ 1469.912910][T14302] loop0: rw=1, want=4977, limit=128 [ 1469.926273][T14290] loop0: rw=2049, want=7289, limit=128 [ 1470.198262][ T223] tipc: TX() has been purged, node left! 01:30:19 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:30:19 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x2, 0x0, &(0x7f0000000580), 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) getpeername$unix(r2, &(0x7f0000000040), &(0x7f00000000c0)=0x6e) fadvise64(r0, 0x4, 0x0, 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, 0x0, 0xffffffff) r5 = openat$cgroup(r4, &(0x7f0000000100)='syz0\x00', 0x200002, 0x0) ioctl$FS_IOC_SETFLAGS(r5, 0x40086602, &(0x7f00000001c0)=0x8) getresuid(&(0x7f0000000280), &(0x7f0000000340), &(0x7f0000000380)=0x0) r7 = inotify_init1(0x0) fcntl$setown(r7, 0x8, 0xffffffffffffffff) fcntl$getownex(r7, 0x10, &(0x7f000045fff8)={0x0, 0x0}) rt_sigqueueinfo(r8, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffff9}) r9 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r9, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r9, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r10 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r9, r10, 0x0, 0xffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000480)={r8, r10, 0x0, 0x1a, &(0x7f0000000400)='&cpusettrusted$]cpuset&-\'\x00', 0xffffffffffffffff}, 0x30) r12 = inotify_init1(0x0) fcntl$setown(r12, 0x8, 0xffffffffffffffff) fcntl$getownex(r12, 0x10, &(0x7f000045fff8)={0x0, 0x0}) rt_sigqueueinfo(r13, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffff9}) kcmp(r11, r13, 0x3, 0xffffffffffffffff, r4) fsetxattr$security_capability(r0, &(0x7f0000000240)='security.capability\x00', &(0x7f00000003c0)=@v3={0x3000000, [{0x0, 0x81}, {0x80000001, 0x1}], r6}, 0x18, 0x1) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x80, 0x0) 01:30:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1470.398942][T14461] FAT-fs (loop0): bogus number of reserved sectors [ 1470.419323][T14461] FAT-fs (loop0): Can't find a valid FAT filesystem 01:30:19 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1470.548182][ C0] net_ratelimit: 20 callbacks suppressed [ 1470.548191][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1470.548234][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1470.553893][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1470.559650][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:30:19 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) 01:30:19 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x80000001, 0x0) [ 1470.787269][T14439] attempt to access beyond end of device [ 1470.877919][T14439] loop5: rw=2049, want=130, limit=128 [ 1470.907654][T14439] buffer_io_error: 14 callbacks suppressed [ 1470.907665][T14439] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1470.934288][T14439] attempt to access beyond end of device [ 1470.940384][T14439] loop5: rw=2049, want=131, limit=128 [ 1470.951751][T14439] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1470.961399][T14439] attempt to access beyond end of device [ 1470.967185][T14439] loop5: rw=2049, want=132, limit=128 [ 1470.974070][T14439] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1470.983040][T14439] attempt to access beyond end of device [ 1471.000192][T14439] loop5: rw=2049, want=133, limit=128 [ 1471.011031][T14439] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1471.019776][T14439] attempt to access beyond end of device [ 1471.025535][T14439] loop5: rw=2049, want=142, limit=128 [ 1471.031172][T14439] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1471.040874][T14439] attempt to access beyond end of device [ 1471.046637][T14439] loop5: rw=2049, want=143, limit=128 [ 1471.052387][T14439] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1471.061131][T14439] attempt to access beyond end of device [ 1471.067019][T14439] loop5: rw=2049, want=144, limit=128 [ 1471.072844][T14439] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1471.081585][T14439] attempt to access beyond end of device [ 1471.087364][T14439] loop5: rw=2049, want=145, limit=128 [ 1471.099816][T14439] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1471.124119][T14439] attempt to access beyond end of device [ 1471.130109][T14439] loop5: rw=2049, want=2673, limit=128 [ 1471.141406][T14439] attempt to access beyond end of device [ 1471.147128][T14439] loop5: rw=2049, want=4721, limit=128 [ 1471.164155][T14439] attempt to access beyond end of device [ 1471.170101][T14439] loop5: rw=2049, want=7185, limit=128 [ 1471.183832][T14439] attempt to access beyond end of device [ 1471.209312][T14439] loop5: rw=2049, want=9505, limit=128 [ 1471.222498][T14467] FAT-fs (loop0): bogus number of reserved sectors [ 1471.240140][T14439] attempt to access beyond end of device [ 1471.247044][T14439] loop5: rw=2049, want=11233, limit=128 [ 1471.254065][T14467] FAT-fs (loop0): Can't find a valid FAT filesystem [ 1471.348209][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1471.354035][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1471.428229][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1471.434062][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1471.508226][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1471.514022][ C0] protocol 88fb is buggy, dev hsr_slave_1 01:30:22 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000800100"}) 01:30:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:22 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x80000001, 0x0) 01:30:22 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vf!t\xee', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16, 0x1f}], 0x140000, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0xffaf) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f0000000240)={0x14, 0xffffffffffffff73, 0xfa00, {r4, 0x30, 0x0, @ib={0x1b, 0x9, 0x0, {"ed1d1b7a19367393b99868f8ab49cbe7"}}}}, 0x90) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f00000005c0)={0x9, 0x108, 0xfa00, {r4, 0x20, '9Z\a', "59f8def3f97f731e430fd0138df480e1c1580ed1a9d215d8d946f082a02cb3b51134abf3b9c427ba243426d417fee7563b077150c52db5a925e5ca106fed5bec96fa24aca4fdf716e9f0b2e61947dc6fefc397fad833b7df9ebc929a76d318c917f359eb8ee8e655c51539e408c10f9e7f1e6e6fa162d37f78f55eaa67425bbf99de3b62f8630e723deacae530377556dfa6037e9e76bebba1086eb53edee3ef9d2df0706758d8e5661d4f323a79171e8edc5afd531caaefbf6c4403087b1f80bee81cc1c58f83e0751181aa6f09410909c8520cc21247cc3ae4407cd605f05aa6e71a34927be6e03f27f0ea8c012dfb2ab4891f1646828b4befe83c2e892d21"}}, 0x110) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r5 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r5, 0x0, 0xffffffff) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 01:30:22 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x20001, 0x0) r1 = inotify_init1(0x0) r2 = accept4$x25(r1, &(0x7f0000000200)={0x9, @remote}, &(0x7f0000000240)=0x12, 0x1800) sendfile(r1, r2, &(0x7f0000000280)=0x1, 0x80000000000) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f000045fff8)={0x0, 0x0}) rt_sigqueueinfo(r3, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffff9}) fcntl$setownex(r0, 0xf, &(0x7f00000001c0)={0x3, r3}) chdir(&(0x7f0000000180)='./file0\x00') r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r4, 0x0, 0x0, 0x4) r5 = accept4$x25(0xffffffffffffffff, &(0x7f0000000000)={0x9, @remote}, &(0x7f0000000040)=0x12, 0x800) connect(r5, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r4, 0x4, 0x1, 0x2, 0x4, {0xa, 0x4e20, 0x1, @empty, 0x2}}}, 0x80) 01:30:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000300"}) 01:30:22 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, 0xffffffffffffffff, 0x0, 0x80000001, 0x0) [ 1473.855839][T14510] IPVS: ftp: loaded support on port[0] = 21 01:30:22 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000500"}) 01:30:23 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet_udp(0x2, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r1) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfef0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x80000001, 0x0) 01:30:23 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) getsockname(r1, &(0x7f0000000000)=@xdp, &(0x7f0000000080)=0x80) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1474.796480][T14595] attempt to access beyond end of device [ 1474.808383][T14595] loop5: rw=1, want=130, limit=128 [ 1474.898754][T14595] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1474.946134][T14595] attempt to access beyond end of device [ 1474.964855][T14595] loop5: rw=1, want=131, limit=128 [ 1475.010292][T14595] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1475.093936][T14595] attempt to access beyond end of device [ 1475.113611][T14595] loop5: rw=1, want=132, limit=128 [ 1475.137090][T14595] attempt to access beyond end of device [ 1475.157109][T14595] loop5: rw=1, want=133, limit=128 [ 1475.174945][T14595] attempt to access beyond end of device [ 1475.216232][T14595] loop5: rw=1, want=142, limit=128 [ 1475.253351][T14595] attempt to access beyond end of device [ 1475.286049][T14595] loop5: rw=1, want=143, limit=128 [ 1475.303691][T14595] attempt to access beyond end of device 01:30:24 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:24 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000600"}) 01:30:24 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet_udp(0x2, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r1) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfef0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x80000001, 0x0) 01:30:24 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c6a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x19) fadvise64(r0, 0x0, 0x0, 0x4) [ 1475.345017][T14595] loop5: rw=1, want=144, limit=128 [ 1475.364970][T14595] attempt to access beyond end of device [ 1475.409034][T14595] loop5: rw=1, want=145, limit=128 01:30:24 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:30:24 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") r1 = socket$inet_udp(0x2, 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r1) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0xfef0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x80000001, 0x0) [ 1475.530800][T14595] attempt to access beyond end of device [ 1475.536563][T14595] loop5: rw=1, want=4017, limit=128 01:30:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) [ 1475.571948][T14620] attempt to access beyond end of device [ 1475.578457][ T223] tipc: TX() has been purged, node left! [ 1475.588206][ C0] net_ratelimit: 20 callbacks suppressed [ 1475.588214][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1475.599737][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1475.657541][T14595] attempt to access beyond end of device [ 1475.667958][T14620] loop0: rw=1, want=130, limit=128 [ 1475.673325][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1475.673386][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1475.673530][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1475.673578][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1475.720498][T14595] loop5: rw=1, want=6745, limit=128 01:30:24 executing program 4: socket$inet6(0xa, 0x80003, 0x6b) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 01:30:24 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1475.752629][T14586] attempt to access beyond end of device [ 1475.772209][T14620] attempt to access beyond end of device [ 1475.773247][T14586] loop5: rw=2049, want=8033, limit=128 [ 1475.814653][T14595] attempt to access beyond end of device [ 1475.820492][T14620] loop0: rw=1, want=131, limit=128 [ 1475.848319][T14595] loop5: rw=1, want=8121, limit=128 [ 1475.860736][T14586] attempt to access beyond end of device [ 1475.866989][T14620] attempt to access beyond end of device [ 1475.884322][T14586] loop5: rw=2049, want=8193, limit=128 [ 1475.907706][T14595] attempt to access beyond end of device [ 1475.922986][T14620] loop0: rw=1, want=132, limit=128 [ 1475.936429][T14595] loop5: rw=1, want=8201, limit=128 [ 1475.944514][T14586] attempt to access beyond end of device 01:30:24 executing program 4: socket$inet6(0xa, 0x80003, 0x6b) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) [ 1475.956138][T14586] loop5: rw=2049, want=8209, limit=128 [ 1475.962939][T14620] buffer_io_error: 8 callbacks suppressed [ 1475.962952][T14620] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1475.979849][T14595] attempt to access beyond end of device [ 1476.004445][T14595] loop5: rw=1, want=8217, limit=128 [ 1476.016865][T14620] attempt to access beyond end of device [ 1476.026912][T14586] attempt to access beyond end of device [ 1476.045669][T14586] loop5: rw=2049, want=8225, limit=128 [ 1476.055043][T14620] loop0: rw=1, want=133, limit=128 [ 1476.064922][T14595] attempt to access beyond end of device [ 1476.088276][T14595] loop5: rw=1, want=8233, limit=128 [ 1476.097928][T14620] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1476.105701][T14586] attempt to access beyond end of device [ 1476.112877][T14586] loop5: rw=2049, want=8241, limit=128 [ 1476.122027][T14620] attempt to access beyond end of device [ 1476.124619][T14595] attempt to access beyond end of device [ 1476.140771][T14595] loop5: rw=1, want=8249, limit=128 [ 1476.145508][T14620] loop0: rw=1, want=142, limit=128 [ 1476.151055][T14586] attempt to access beyond end of device [ 1476.156254][T14620] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1476.171617][T14586] loop5: rw=2049, want=8257, limit=128 [ 1476.182139][T14595] attempt to access beyond end of device [ 1476.193958][T14595] loop5: rw=1, want=8265, limit=128 [ 1476.210403][T14586] attempt to access beyond end of device [ 1476.217701][T14620] attempt to access beyond end of device [ 1476.228282][T14586] loop5: rw=2049, want=8273, limit=128 [ 1476.238515][T14595] attempt to access beyond end of device [ 1476.255002][T14595] loop5: rw=1, want=8281, limit=128 [ 1476.264002][T14586] attempt to access beyond end of device [ 1476.276840][T14620] loop0: rw=1, want=143, limit=128 [ 1476.282521][T14586] loop5: rw=2049, want=8289, limit=128 [ 1476.294526][T14595] attempt to access beyond end of device [ 1476.300310][T14595] loop5: rw=1, want=8297, limit=128 [ 1476.306462][T14595] attempt to access beyond end of device [ 1476.311768][T14610] attempt to access beyond end of device [ 1476.318051][T14620] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1476.318551][T14610] loop0: rw=2049, want=2193, limit=128 [ 1476.326953][T14620] attempt to access beyond end of device [ 1476.326968][T14620] loop0: rw=1, want=144, limit=128 [ 1476.326985][T14620] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1476.327012][T14620] attempt to access beyond end of device [ 1476.338637][T14610] attempt to access beyond end of device [ 1476.349717][T14586] attempt to access beyond end of device [ 1476.352517][T14610] loop0: rw=2049, want=4241, limit=128 [ 1476.357585][T14586] loop5: rw=2049, want=8305, limit=128 [ 1476.357677][T14595] loop5: rw=1, want=8881, limit=128 [ 1476.363917][T14620] loop0: rw=1, want=145, limit=128 [ 1476.405376][T14610] attempt to access beyond end of device [ 1476.422266][T14610] loop0: rw=2049, want=6289, limit=128 [ 1476.433959][T14610] attempt to access beyond end of device [ 1476.444143][T14620] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1476.456029][T14610] loop0: rw=2049, want=6633, limit=128 01:30:25 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7f, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0xffffffffffffffe7}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') write$UHID_INPUT(0xffffffffffffffff, &(0x7f00000015c0), 0x10000005c) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x4) 01:30:25 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1476.788206][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1476.788242][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1476.793992][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1477.598175][ C1] protocol 88fb is buggy, dev hsr_slave_0 01:30:27 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:27 executing program 4: socket$inet6(0xa, 0x80003, 0x6b) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 01:30:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) 01:30:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:27 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000000)={{0xfa34, 0x3, 0xa1d, 0x6}, 'syz0\x00', 0x35}) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) ioctl$SNDRV_PCM_IOCTL_WRITEN_FRAMES(r2, 0x40184152, &(0x7f00000001c0)={0x0, &(0x7f0000000100)=[&(0x7f0000000080)="850583fa99e1d3893f4030e76aa0299ac38d5ebfd65e2fb5ea9d80fc02e4cb2458530256ac4bb9b48d942b614db049924ce48b466de78773d36618d63235498544173a22c0121edecc890f23ee21c9"], 0x80000001}) 01:30:27 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0xffffffffffffffff, 0x0, 0x4) 01:30:27 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000ff00"}) 01:30:28 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) [ 1479.277814][T14684] attempt to access beyond end of device [ 1479.329496][T14684] loop0: rw=1, want=130, limit=128 01:30:28 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000100"}) [ 1479.400641][T14676] IPVS: ftp: loaded support on port[0] = 21 [ 1479.404542][T14684] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1479.522478][T14684] attempt to access beyond end of device [ 1479.568606][T14684] loop0: rw=1, want=131, limit=128 01:30:28 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 01:30:28 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000800100"}) [ 1479.631719][T14684] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1479.792602][T14684] attempt to access beyond end of device [ 1479.834094][T14684] loop0: rw=1, want=132, limit=128 01:30:28 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) [ 1479.869969][T14684] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1479.985313][T14666] attempt to access beyond end of device [ 1480.078408][T14666] loop5: rw=2049, want=130, limit=128 [ 1480.084008][T14666] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1480.093477][T14684] attempt to access beyond end of device [ 1480.144359][T14666] attempt to access beyond end of device [ 1480.148217][T14684] loop0: rw=1, want=133, limit=128 [ 1480.178703][T14666] loop5: rw=2049, want=131, limit=128 [ 1480.182239][T14677] attempt to access beyond end of device [ 1480.184362][T14666] attempt to access beyond end of device [ 1480.214717][T14684] attempt to access beyond end of device [ 1480.220609][T14666] loop5: rw=2049, want=132, limit=128 [ 1480.226805][T14684] loop0: rw=1, want=142, limit=128 [ 1480.242705][T14666] attempt to access beyond end of device [ 1480.255267][T14677] loop0: rw=2049, want=2481, limit=128 [ 1480.261082][T14684] attempt to access beyond end of device [ 1480.266870][T14666] loop5: rw=2049, want=133, limit=128 [ 1480.282779][T14684] loop0: rw=1, want=143, limit=128 [ 1480.288031][T14666] attempt to access beyond end of device [ 1480.301141][T14677] attempt to access beyond end of device [ 1480.306954][T14684] attempt to access beyond end of device [ 1480.317094][T14666] loop5: rw=2049, want=142, limit=128 [ 1480.324767][T14666] attempt to access beyond end of device [ 1480.334734][T14677] loop0: rw=2049, want=3585, limit=128 [ 1480.342472][T14684] loop0: rw=1, want=144, limit=128 [ 1480.347680][T14666] loop5: rw=2049, want=143, limit=128 [ 1480.360996][T14684] attempt to access beyond end of device [ 1480.366716][T14666] attempt to access beyond end of device [ 1480.377331][T14684] loop0: rw=1, want=145, limit=128 [ 1480.384671][T14666] loop5: rw=2049, want=144, limit=128 [ 1480.412260][T14666] attempt to access beyond end of device [ 1480.417922][T14666] loop5: rw=2049, want=145, limit=128 [ 1480.460501][T14666] attempt to access beyond end of device [ 1480.466222][T14666] loop5: rw=2049, want=3073, limit=128 [ 1480.493612][T14666] attempt to access beyond end of device [ 1480.517119][T14666] loop5: rw=2049, want=5337, limit=128 01:30:29 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:29 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000200"}) 01:30:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:29 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:29 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000e00000/0x200000)=nil, 0x200000, 0x0, 0x20010, r0, 0x98378000) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x192, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100007ff, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x7}, 0x0, 0xfffffffffffeffef, 0xffffffffffffffff, 0x0) setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:29 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) getsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f0000000000)=0x200, &(0x7f0000000040)=0x4) [ 1480.948169][ C1] net_ratelimit: 19 callbacks suppressed [ 1480.948177][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1480.948202][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1480.953915][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1480.983061][T14775] attempt to access beyond end of device [ 1481.008498][ T223] tipc: TX() has been purged, node left! [ 1481.010840][T14775] loop5: rw=1, want=130, limit=128 [ 1481.038790][T14775] buffer_io_error: 12 callbacks suppressed [ 1481.038802][T14775] Buffer I/O error on dev loop5, logical block 129, lost async page write 01:30:29 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000300"}) [ 1481.078896][T14775] attempt to access beyond end of device 01:30:29 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:29 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000400"}) [ 1481.169404][T14775] loop5: rw=1, want=131, limit=128 [ 1481.187852][T14775] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1481.263474][T14775] attempt to access beyond end of device [ 1481.291799][T14775] loop5: rw=1, want=132, limit=128 01:30:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000500"}) [ 1481.317046][T14775] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1481.381484][T14775] attempt to access beyond end of device [ 1481.402449][T14775] loop5: rw=1, want=133, limit=128 01:30:30 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1481.448276][T14775] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1481.500962][T14775] attempt to access beyond end of device 01:30:30 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000600"}) [ 1481.543779][T14775] loop5: rw=1, want=142, limit=128 [ 1481.608335][T14775] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1481.719594][T14775] attempt to access beyond end of device [ 1481.748151][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1481.753960][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1481.807404][T14775] loop5: rw=1, want=143, limit=128 [ 1481.828161][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1481.834002][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1481.872764][T14725] attempt to access beyond end of device [ 1481.904353][T14775] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1481.908229][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1481.918729][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1481.921374][T14725] loop5: rw=2049, want=2201, limit=128 [ 1481.924561][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1481.949857][T14775] attempt to access beyond end of device [ 1481.955503][T14775] loop5: rw=1, want=144, limit=128 [ 1481.968781][T14775] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1481.972549][T14725] attempt to access beyond end of device [ 1481.977430][T14775] attempt to access beyond end of device [ 1481.977444][T14775] loop5: rw=1, want=145, limit=128 [ 1481.977461][T14775] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1481.987187][T14725] loop5: rw=2049, want=5353, limit=128 [ 1482.011362][T14775] attempt to access beyond end of device [ 1482.011365][T14725] attempt to access beyond end of device [ 1482.011381][T14725] loop5: rw=2049, want=5665, limit=128 [ 1482.024949][T14775] loop5: rw=1, want=5681, limit=128 01:30:33 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:33 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'}) 01:30:33 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000080)={0x11a, 0x4}) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f0000002600)={0x8, {"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000df00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000", 0x330}}, 0x1000001c5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x7, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) fadvise64(r2, 0x0, 0x0, 0x4) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r4, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") ppoll(&(0x7f0000000040)=[{}], 0x1, 0x0, &(0x7f00000000c0), 0x20000048) r5 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r5, 0x0, 0xffffffff) futimesat(r5, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)={{0x77359400}}) 01:30:33 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r1, 0x0, 0xffffffff) ioctl$NBD_DISCONNECT(r1, 0xab08) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r2, &(0x7f00000015c0), 0x10000005c) inotify_add_watch(r2, &(0x7f0000000000)='./file0\x00', 0x40000000) fadvise64(r2, 0x0, 0x0, 0x4) 01:30:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}) [ 1484.655502][T15075] attempt to access beyond end of device [ 1484.787513][T15132] IPVS: ftp: loaded support on port[0] = 21 [ 1484.800260][T15075] loop0: rw=1, want=130, limit=128 01:30:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>\x00'}) [ 1484.840377][T15075] Buffer I/O error on dev loop0, logical block 129, lost async page write [ 1484.878503][T15075] attempt to access beyond end of device 01:30:33 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00'}) [ 1484.964978][T15075] loop0: rw=1, want=131, limit=128 [ 1485.043166][T15075] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1485.101613][T15075] attempt to access beyond end of device 01:30:33 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}) [ 1485.159210][T15075] loop0: rw=1, want=132, limit=128 01:30:33 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1485.201282][T15075] attempt to access beyond end of device [ 1485.245717][T15075] loop0: rw=1, want=133, limit=128 [ 1485.291259][T15075] attempt to access beyond end of device [ 1485.375544][T15092] attempt to access beyond end of device [ 1485.386245][T15075] loop0: rw=1, want=142, limit=128 [ 1485.406642][T15092] loop0: rw=2049, want=2201, limit=128 [ 1485.429054][T15075] attempt to access beyond end of device [ 1485.462821][T15092] attempt to access beyond end of device [ 1485.468962][T17137] tipc: TX() has been purged, node left! [ 1485.501657][T15075] loop0: rw=1, want=143, limit=128 [ 1485.521434][T15092] loop0: rw=2049, want=4249, limit=128 [ 1485.527235][T15075] attempt to access beyond end of device [ 1485.535057][T15075] loop0: rw=1, want=144, limit=128 [ 1485.555557][T15092] attempt to access beyond end of device [ 1485.575419][T15075] attempt to access beyond end of device [ 1485.585945][T15092] loop0: rw=2049, want=6481, limit=128 [ 1485.595166][T15075] loop0: rw=1, want=145, limit=128 [ 1485.595246][T15092] attempt to access beyond end of device [ 1485.606458][T15092] loop0: rw=2049, want=7161, limit=128 [ 1485.998189][ C0] net_ratelimit: 19 callbacks suppressed [ 1485.998195][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1486.009666][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1486.068193][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1486.073968][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1486.079820][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1486.085568][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1487.188181][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1487.188210][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1487.193968][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1487.998154][ C1] protocol 88fb is buggy, dev hsr_slave_0 01:30:37 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000fffffdfd00"}) 01:30:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:37 executing program 4: socket$inet6(0xa, 0x80003, 0x6b) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 01:30:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x1, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:37 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB="2f73782e7666617400bf8ece36729b37e1819cbc9b288080a65a71bfdec32f48f9127a274468f85785e22829fa8319a347784258b5d022a35a7d9195997f4d70b712fb822cf2cec13c4a309a60165f3f3f0af8585d2a78bb7d5134e3886aaa225bd3662418821297fc959877a5357da448b482e17a081aece8c71ee35dde87c75550cfc0e3235a6be87f195d3fed637abbc41f498f1fb6a1ed86e06acefc6fc1ee5f1926213a7b363bb44a1fa73743b49cf36669c0474578045869c748d2ded727ce753862ec6e6ee2a111909c6be2a44d1f1b3a758d56343ebaf7c2ffeee7c0a4d1efc95c52d2dd7f319f17e8a56ec4ee840b91276d307e0d08110c573a045dead5f74e779d9031245d51b855b9b1a95da75dcdbe5511e37ebeafd19bb349db2ff488099fba028d937bb02da5e726fd80d4c4d1bd93e9fd904752d5da72fdb9b285cca8b254a44e0b00dbbb571a4fef57ada39aaca20e4c115c52123fcef8cd3f1f1e2c26e0654c8ca1f0121ecb70b61eedbc5fccca7082ae653e043824887d83998adc04e06fdbb94a76e2bc7da32b"], &(0x7f0000000080)='trusted\x00', 0x8, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x9b, 0x0, 0x0, 0x0, 0x0, 0x800000007f, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r1, r2, 0x0, 0xffffffff) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r3, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r3, r4, 0x0, 0xffffffff) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r5, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r6 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r5, r6, 0x0, 0xffffffff) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000000300)={r4, r6, 0xfff, 0x4f, &(0x7f00000000c0)="a38fcf5a6e826c13eb44bb3d686f9752af28b70d17966261030fb9168e19d25209a59e780c6c6f84480536bd3c7326c7a5bbcef5e5798fe09af06f9fc26886206f3ae0fa8e2d04055f25e6582a981b", 0x4, 0x0, 0x2, 0x417b, 0x3, 0x0, 0x7, 'syz0\x00'}) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000000000ff00"}) 01:30:37 executing program 4: socket$inet6(0xa, 0x80003, 0x6b) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 01:30:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "0000000000000000000000fdfdffff00"}) 01:30:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000001"}) 01:30:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000008001"}) 01:30:37 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x20000441) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f00000015c0), 0x10000005c) fadvise64(r1, 0x0, 0x0, 0x4) [ 1489.237641][T15451] IPVS: ftp: loaded support on port[0] = 21 [ 1489.291338][T15475] attempt to access beyond end of device [ 1489.312568][T15475] loop5: rw=1, want=130, limit=128 [ 1489.330873][T15475] buffer_io_error: 6 callbacks suppressed [ 1489.330956][T15475] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1489.454335][T15475] attempt to access beyond end of device [ 1489.488219][T15475] loop5: rw=1, want=131, limit=128 [ 1489.493369][T15475] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1489.601761][T15475] attempt to access beyond end of device [ 1489.607720][T15475] loop5: rw=1, want=132, limit=128 [ 1489.622385][T15475] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 1489.642050][T15475] attempt to access beyond end of device [ 1489.653455][T15475] loop5: rw=1, want=133, limit=128 [ 1489.672013][T15475] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 1489.691100][T15475] attempt to access beyond end of device [ 1489.708160][T15475] loop5: rw=1, want=142, limit=128 [ 1489.732136][T15475] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 1489.761027][T15475] attempt to access beyond end of device [ 1489.773582][T15475] loop5: rw=1, want=143, limit=128 [ 1489.785000][T15475] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 1489.803750][T15475] attempt to access beyond end of device [ 1489.816420][T15475] loop5: rw=1, want=144, limit=128 [ 1489.835312][T15475] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 1489.854998][T15475] attempt to access beyond end of device [ 1489.867520][T15475] loop5: rw=1, want=145, limit=128 [ 1489.885663][T15475] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 1489.950518][T15475] attempt to access beyond end of device [ 1489.994029][T15475] loop5: rw=1, want=2201, limit=128 [ 1490.040580][T15475] attempt to access beyond end of device [ 1490.076675][T15475] loop5: rw=1, want=5721, limit=128 [ 1490.125631][T15475] attempt to access beyond end of device [ 1490.140558][T15471] attempt to access beyond end of device [ 1490.146446][T15475] loop5: rw=1, want=7769, limit=128 [ 1490.153111][T15471] loop5: rw=2049, want=8001, limit=128 01:30:39 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:39 executing program 4: socket$inet6(0xa, 0x80003, 0x6b) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r2) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 01:30:39 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000002"}) 01:30:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:39 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) ioctl$SNDRV_PCM_IOCTL_PAUSE(r0, 0x40044145, &(0x7f0000000000)=0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:39 executing program 5: clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f00000001c0)={@hyper}) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000040)={0xfffffffd, 0xa, 0x4, 0x100000, 0x7fff, {r0, r1/1000+10000}, {0x2, 0x2, 0x80, 0x1d, 0x0, 0x7, "6b65c424"}, 0x4, 0x2, @offset=0x6, 0x1, 0x0, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(0xffffffffffffffff, 0xc0505350, &(0x7f0000000200)={{0x0, 0x4}, {0x7, 0x6}, 0x7fffffff, 0xe106cbd03a785478, 0xf1}) setsockopt$inet_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000000c0)=@gcm_256={{0x304}, "19835d6abeeac9b3", "00dc40d8f6a8c5ce6455d2431d32521ba69f9ba1457f978a0e755456f0604742", "b5007610", "d6cde2904c9b941f"}, 0x38) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r4 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f00000015c0), 0x10000005c) fadvise64(r4, 0x0, 0x0, 0x4) 01:30:39 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000003"}) 01:30:39 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x0, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1490.728762][T15510] attempt to access beyond end of device [ 1490.748171][ T307] tipc: TX() has been purged, node left! [ 1490.802171][T15510] loop5: rw=1, want=130, limit=128 [ 1490.807415][T15510] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 1490.824810][T15511] IPVS: ftp: loaded support on port[0] = 21 01:30:39 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x0, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1490.874556][T15510] attempt to access beyond end of device 01:30:39 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x0, &(0x7f00000001c0)="0805b5055e0bcfe8474071") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:39 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000004"}) [ 1490.948803][T15510] loop5: rw=1, want=131, limit=128 [ 1490.960334][T15510] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 1491.010591][T15510] attempt to access beyond end of device [ 1491.076744][T15510] loop5: rw=1, want=132, limit=128 [ 1491.076839][T15510] attempt to access beyond end of device 01:30:39 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1491.172419][T15510] loop5: rw=1, want=133, limit=128 [ 1491.218347][T15510] attempt to access beyond end of device [ 1491.245839][T15510] loop5: rw=1, want=142, limit=128 [ 1491.273748][T15510] attempt to access beyond end of device [ 1491.312819][T15510] loop5: rw=1, want=143, limit=128 [ 1491.334278][T15510] attempt to access beyond end of device [ 1491.348200][ C0] net_ratelimit: 19 callbacks suppressed [ 1491.348208][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1491.348239][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1491.353897][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1491.379887][T15510] loop5: rw=1, want=144, limit=128 [ 1491.519339][T15510] attempt to access beyond end of device [ 1491.533365][T15510] loop5: rw=1, want=145, limit=128 [ 1491.542088][T15510] attempt to access beyond end of device [ 1491.547744][T15510] loop5: rw=1, want=4505, limit=128 [ 1491.557032][T15498] attempt to access beyond end of device [ 1491.579324][T15498] loop5: rw=2049, want=2089, limit=128 [ 1492.158157][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1492.163955][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1492.228183][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1492.233980][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1492.308231][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1492.314064][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1492.319948][ C0] protocol 88fb is buggy, dev hsr_slave_0 01:30:43 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:43 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000005"}) 01:30:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:43 executing program 5: r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000080)={0x7fff, 0x6, 0x3f, 0x1, 0x3, 0x4dfd}) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1a) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r3 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r2, r3, 0x0, 0xffffffff) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r3, 0x80045301, &(0x7f00000001c0)) r4 = syz_open_procfs(0x0, &(0x7f0000000200)='net/dev_mcast\x00') r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote, 0x4}, 0x1c) connect$inet6(r5, &(0x7f0000000300)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) r6 = syz_open_procfs(0x0, &(0x7f0000000440)='pag\xd4\x8cE\xf8\x00') sendfile(r5, r6, 0x0, 0xffffffff) setsockopt$X25_QBITINCL(r6, 0x106, 0x1, &(0x7f00000000c0), 0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x200, 0x0) sendfile(r1, r4, 0x0, 0xffffffff) ioctl$SNDCTL_DSP_GETIPTR(r4, 0x800c5011, &(0x7f0000000040)) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r7 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r7, &(0x7f00000015c0), 0x10000005c) fadvise64(r7, 0x0, 0x0, 0x4) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0xc8800, 0x0) 01:30:43 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) unshare(0x40000400) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:43 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) sendmmsg$nfc_llcp(r0, &(0x7f00000004c0)=[{&(0x7f0000000000)={0x27, 0x0, 0x2, 0x1, 0x1, 0x4, "7f6fba99e060c74732e990770f9f42e3ab34d6db1387a5e1c37303d41323d31a69210171c11209dc68c05e9119575a46d328bdd1a8252e0cfccb93169c6619", 0x37}, 0x60, &(0x7f0000000240)=[{&(0x7f0000000080)="6286c7313b957bff9d2cd06375a91d4174c60166ab4d183a19e4e7fba6f06ee9ec146176b75cefe26cd0bbb7bdf630b39ed9e48766cf45b487c4023c80cab9e5cc672ff4f2e4924b1a03174df55ea4e82be0544664781fa79a53476657a951c2318c35d31c62d4a27eb12db1c7524a048366794098e5f10c3efcff19e5944e880e764e3a7086d40d67e6bf71c240894fe3b973f2be88c809e2f154bd669c9144158118d904c5c7bca9bff6622e462fa6ae40b06e", 0xb4}, {&(0x7f00000001c0)="9b7e6fab05f6b9777e15ec098de7f5f842d740b9509aa742c116947c6fc5807cd8293cd6cdf140ffb907ceecb88c97ed1594aec1a3f8063ebd7c64ceeceeac3da7c7471aa2674c7d", 0x48}, {&(0x7f00000005c0)="a6ed804bf93ad32fe0819e145efc3da81873d3c85ff18df3610f1e6c6b1c2f5c86a5379b17748decc1672d4608578f5bd94ffbc3ed16509c4ec8bfce0388eea336cf5c5d1dbc5117f5279ad2830e9f7e118d9c4fb250a12ce6960ca5303f9c75bb833bed82bf619ce1dbe108d7f6aa578ab5a7e033913667afbef91a282477811f2bc6648ea360e24b0a1ac150a6a35d65a6e7142080b07633d0ce1553c91ddc86b212ddb4efea473ee15e57aeaf10853736c6c02493861a42a4c76c4a67cb36bd3408a9384c7ced4a654f6c9c33fcb91876415ddf78b1a6732a807b098f211e0e48fa669c96d7da2f2584e586eda38f80a39e43239c65fc81aef558be35fa1308d1c806d190fe02a236fe7ad7a470aa932d4600bbb3d4b48fa7c9d0fdef744d475a567ffc35cca07b06f1e1e06ff0437f5abfa1bc18e64efecb43960666e8a9b23396ceebaae8f8c17dd5bc9a969e8b094fa6e17f919ed4b5d4245d87e59566b04c22174f507d718f5b3f29e7a5069ddc67d053289ba3499887cc50f1c40b0bce421196c39f62f21f6cb52acec7fd5c0885fb0b181568631fccd5d3a61d0ed352578b7a5f3b83c7c3292f72fd7eaa7222eb2b32844f4232ae958ab019df3c455853989a63a345b3cb09f71271cece45775619fab576497c0730f99ef4aaa94af488fc156a475f7117366a09caed489411cdd0c3707e882c9796c2152a9b6ebc68846866ffcd5b5c5eaff425fe6d76ab81272d10a24f00aa0798f075f9ed9179377b223e4293f48d052a4f0b911483f0bc0c839255c9270da0340dbfce98fb883095ee6e636011ec8cbc47a864f35494e65afbdde98e113475a2b81c03513345788a9b9f1c52c07e5553e9835ac58eadd983148209dc44de81aec8ab4616028d431302e7c8b58865b1c5cdd4a7811fe45bc905ffad143cb1badf3bb8b2bc6b342b65e318c76a2d5e8aba9e58e2459b1f60eea73dca0067695ecfce5fb29af465f55ed8adf1e6eb240e909d62a7c437c6fa0034cb2c990af472c5242037e84fed713dbaa79d1659958622f1494498080ff0dc9c1d961abd9241e54bbdd3e8c9cf4723aa85b25ac6c60df6ed71c53a21a6f22f448dfa85e79e01261c3e8ccaa434df8ad0655d1e3d4b1056048ca9f5a7a9f078d802b7f43968b885a5599bb2329239b7721f292da35733241993ac72277b2bcfd8120ac95c939b821406dd5e065c66af61cc6ee790b36b741c8fc073fbc772be8a5653f00750261e24e772ce12d5072f0211b8d67cbfe4728fa81a365a82e703b5bf00af048730f55bd43b8f2ad118f198f1a9950cfe2e8f9bd64f51487584d14662a9653ee333af17263e77ac4b6c8306f68e4872f7c59df9b504b837d0cdc6b20149953084abdae08f26b3d005080c97f86b8f8b296127f0f2e8354557736c48d3bd067a79615bf59866526b5a667b56fc5919e281bc7058493c7d5aecba72552fd4f58d745c98a60751027f7afa8bcaa7304039b3a8f9398e0c5a0f1c8af98486dca79b457b09f5f936523f9b31ed8e43491766509e228f7046e44743600a7ae29eb1593beef53a442f1a2e90009336d8e06626bb438fa713735409888493bf031c6f92974b5be9167c51ed334295fdcde9487e0c7a752ab5fbf5becee28ac257dae0e41cf3f2325d4116be8b17d671181f129c9143789dc0c78f24112c13cf817fbbca82a0e6ab9f278396c0ff1f7162b56ae494361c3272ebcc2485cf81050fd3d226f4a58d493fcc06457be4cfae7ab7d1fbe14978af881145972bcf0e0b450ca74046089de0a3af536970bc5685103eeb64053300b4d8de0272cc480eb921fcc08341508ad00ae330e3504a93204716c01a9b05fafa4dcb88c87a7b2f57f7413a34ab79cc1a70775c48805945a0229c353c21676d5339913e622f77cd0a245d06aaa836eadf625910b38e660b8f2d3d64786631db66007e50c121bf4421315dc80527e25fce34dd1889e91254f91d225abaa3ee50e7920b23fadeab1b97b5c222b0369120cec5682d88f78555aaeb857e3817410d85decf6991e95af0e97ce27ca53713587f7b1fcdec8ac08de03e690f6f35f6bd766c12224a087f8a75c553bcbb0ab25a03a440fda22cb4d292bde550920b673535637626882d7e998eaf2abc582bd6a54cea183c17b01d67ffb5db19a56ed6a4732ff4f8c8ed4203b92f767dce97b44a26f2508a4ede4f4e0447696fb849df4a40d5c31b00b017fc9469dc4644c576e68a20019b8dd1861227c386cd6496d369bf02a6bcb3bbeca2195e2816af9d7d5d06ba8cfd98c8abcdc9633e408766188f331bdfb4fd6e00bc3a6423cad9d4fed8e3b702fdcbbbac89ec5171967bad211beeda8eed3413e297dad6c4bd9f36ade3491ee54abf2ccb3a5ee0cc28724f58219115a9af71e9020037489ddeb9260d7b51b5f9fdf9917d91c8c9e30837e9c7ba6bf3cf2955711e8091fcadfca6bb90dfd4f3bd00558d9e7d585e0dd2c93680dc10fe9affcc84b677296c9dca6c85fd9992777934b2a003f0b2aec2c64d9ca47365147a3c4e43c4ece97e70a59b465581439ab28ab8c80cb4666f995a1105b3e7bd12bf750f1e60545ed81a90645ed728890ddc0897e580c5774b3bd7278e3e266e9b6699c75cdf9257346bc6136d33b30c6f550f2c701271b2574a8d1be29e3235e4bdfec9e1d664efc624c281d8f0e99a174cc2044701210351243d66decff926af40cb7746ea04802d8ba642f5793b8b6536d76d8e5983ba770c00df06a4001ddb5d477a36fad55ebce776d0a9393883ea265d3ed8f4912d75ac1545eb02737ccf06bb1fb8d69ec22591e82f194995ef490b581268c5179eb357679f950b7772df17b8de01a835321a80be085b574fa2782c23f752d96162afebd6e1ae92837862e00b1e0c90ed6c942a67fd61f523ef84e167c60fd1a42a528edfda9104cbee56bdfd9338538279b92c5564c360b78cfe1061a1c4f0f2124428ac9bcb930c8cff346535157e0f75a1079403fe348b1086d87d49e4c4df47334d1134e911a7e301671efd6e74cca028d41824d02dc524866f0cdd1930dbab5936dc0b602231be5d334d731c44968bdf976903dcc45919274acd9cfe5912c706faf03c155e393d3121ea925a3072e1e28dbb9e5d64aabba9d9f6102504c3399dfd6edce9386d53639e23cb3f942ff6513f85ea43c4e52b7ecdd176cc42c2f033bc0d96513537707e363f6cf4ffa0ee6271f69e4c785596582ad6e5a93b0616fe43f30d617ce8644b289d0cf95211a9ff8da4fcee2ae4397260d99d9c9e59b7509c6251c41c6016bfad36d8e48f62a1d84f359a6b71d8bfac56138a31b5ace0878bf58ce5a070b626fddce5583c1a5eb00e9531996526830634e605390531bd37685531a7729a9f8bc326c10ed0ad5eb7d8e9578a6b5542958b20e70a22da3b3a83e51ed8b7ead7e4fb7f2a3d6e8eb4c6e99b3ae288ac3e9a66cb32f3e1bce2c6b7bef8410232f580c0112a7c90b04632cd0e5d70c86ba993414e5ba5cce3ca2c70a99d3c8f998f79a8a3d7e78af48a5d5f7e47cdd2d285a025a36bcc6098801a8ea663b93cea946b49451860d0c3f07bdafe02108cc09ca755a4cdc677ba18fa6351fd424d9530f3a0a50cdf7f9ac3fd75139c479900d28ba86776018b80865515d290fe62a6b33f2d7f92733b607e4839cc7c9a5a0baa2118c09f9efc2d16f840eecaa6e3e4b8d66535153267e7c760459451e33442e9e24af52fbfb99ec94986ef43c41dde88641153f3962772c6e79f65b726cb611f80f2893592b2fb00ec97b37a5c565aabff931f583b8c9c946790e8a97e9043e8e7459c441a3080d2dc728566ceef15ac72009ce0b102565eea5bbabc2ccd13b9cefd0af6ee5cd8e4944302f86e17ac6c10b23fbdcf716d0b9e449479ca02b41ffe8586bc07c3364dc13a6bdf6afe912fb9ed99bfb062eb781784918228125611df39e644717297caea6c17146149c9f2be92e8fffe38599ca6b501ae61ed093f09e9b1cb11a3b837c06c51fcd4b4ed6371af73a60a3081d1c6dbff1654e48e248110a44bd5362b943b56cf1db1d1ca89e16184b49f3fea9088efde3b43fb793ce2ac4adf50397de60a5352f5cecb998e128057ef82d0629e56ee83de6da85651e93dafef91efdec2624af02ad487e120cdb7cb6ec5f454d34f21311feb35150602131d510ee86c23205d1ccd4aee466ae6c42bf580358e31e071a31fccf4731be15905d5e5e2c08ec63f8c622fc76c9e7cf4be18c79cba8fbc7d9b8c64c45942f8319a49e0aaaca88f84636d31b5d9981b7db0c42a9577fc375c754e68173d2c95841f8ca16d45b22fd67dd3845b08d6d2f16363d422b9ca97f9c987ddcdf25d340ced8dcce102850d4f533e3efb7c82e7acc09855052e16973fb31fcfa73a8d89151b4006a2b19c606c3fb8533e79fa6ec628051b9826a76f3a59e0a9726e71df862f4a2c5957e5f3d9ec2188d92b6cdd87b9295eebfd7a5c1df0998fce9e243779f7587a0357b8b3297f8141135c967f68d0232af26e26fc2fc68a84df3103388d57696bf30b4d133eebd802cfedec6b372850b8f6afcd68b5afff018dd829b4dbf4eaae1ffed8b8d0b5683dab7dd72c344c9cfc58a8a82d2cf7b32d90e6ed91062a50cbc29ca62670f7f7e3be6f59d5178ad5d57c3f1438772ee1fd759dc1deb7c2cbf4ab67546ebcc3433d7dc3b02c3164d08ff8cb2f0dea93a9a09815d6d4dce752bfad064e0d99f2389f8939030f73cabdfe39eda1caa1c91d40f31b7b086e69c85c8c52ef50021e1e1e61d6f37a22d4cca3f21ac821f2ef67cbaa505833550a9a77b3621113864ebb2973642c03c7852d8386f6fd9af5874e0e921835558e53cbcc1723bde6ae1ac54e7d310fd4ab1f0189fcd51e94b33fd366cf38dea723b4a5595587a97dcc4d775b4f691365bd42f6a85684933cf2792ed37b0ccf99b516798a35ddb921bbaa7dca9b1beaa90bcb76bb11bd55c73bae231193fd6615dc23dd8cda1a0bf21d56cb3a0fb1b3a55c75f0452096ebc7588fe32cf8c4716cf36998bd42a05f72554478d043df838609ad420083dd48c612dc9038b198a40932074ab35086916f9a4cc2710c3691cb93f5aeee793cc2cba82656fcf9cb3134a9bdaa67abe27c262d0ffbd31a8b36f8b832935ed388894cc55086355b8d6c789aaf7639e8a44a9f9ec574c2d380234997b9dfbc317dfa0adc0d2c881cd09939f154520f860b034ded33c6498a1400e21626a8d0fa2dbafc9acdea6c890abb25f0ec26a43a98358ad36c9312dfcaa7a4d028d03d7ffdf6e3d6acf7e9cac1489995086e4f003b776c29130208ffe8e95752df756487af39d711553a4b69c05364a064457913ca717e46bdef376e2a7ccfe5ff4ecffa01173bb8a7dbab6c13ea40fcc6e0e4516daa2ab33191b319e530a99443218e6d0f081421544605a86c945f7af45b61fe5c95187b7b193bb589c5d855ce04a25bf8b3be664d7a5257fac798f5e4c0718a1f6333c3a009146b53a049be7f9226a6c01af3540f0c7070db69eebb84273fc627f7460f098e04f80cba9edd6a3f6e0417b2343248650cd7a9550031ea788cc27f8b94fd15adb5c11fdf0c03ae538bfc27d6a5170b74b964061d6e4bdf823423ea7ebd1bb8eb4b437d85ddf9bc8f18bf03b9277a3a373d6338fefcaf6aa083a090107c3291d66b4ef6c4101fc28cf446fdd56df477229420343d78aa1dab8c874596e7f2d6a4b77d7994ff83a2ed424e315e24be1a23bf6f4cd1a0838a58a4", 0xfffffffffffffd87}, {&(0x7f0000002600)="e38830032a147f79a882f36e3668e4aa9ca3e2040dc0e97ee5bf0dce566c2631c4bf9e1fe1219316a02af0b06d1e5423d0c69f8cad381c9ea1fc325adfbd67ead11432878a040a9f240de629e00776e7bcc2a7cd02d9ddbf93b2573cd5c606326f38ccdf4f50f462739bfd84aa1c0eee0a229f413f9d9d15eca6281e8ff596874c81f5b972426975e8f5dfd8f2c9854b34ba5311a781f35489c9ad16ff6e784e04b412de8e459affd5a1df3d56bdad36440da2ed47d9b0f5208d70f578bd0aa258edeefd0bbe868295b58e26d2019b9bec8a5e1af23be730b66472d11200494ac3a1bac1ada82116549e53eea6ba414230b4dc432dc2389e84ebaa4727da84bc3190512d038917f1a1c953c8d8a14d8756908019cdec5d190eb1f0426e71e050d4b0a5ea03f5aa41d0c435725606a5fe4219f9ea88a174f7b704706ac33790d36a8db6d6fad7b5eb83a04b0255e1d5a2a379f0ddf39eee4a9ceaedca7a4eb2a09aed545be7e7098654d7d4e6a9e5cf1b54c47ed288bce554dc68f65e8306b1266a853cdbf7c862756bbbabca7987a954ed9afc48106d0a026accb55063122cb80fd5c3687dfa223d13085cd4bdbf896ca213c0834f6aae88ba59c81e037eb5f4464d9ca6e653934ed38bccdff9906f3ed5a053fad5b51386b3802e1be8518d2f99023814db121bf43464b8fece3ad6ee61ce157426b3c59061332188129038fe5de9a02886aa481697407bc3072a94ab366cc88e903b8814a00b69d76869b1c9bae866eb68c4b06d39d13de5896c474d454cd2390b383322ecee70c1f99b9d8cf019beb1670136747b5af1b2b8f596b59185b0764646a8556e0ef9ef59f960b82bd37c1bf2731796cd8f5923325ff84f447cf2611bd165ef4662a62b52d01694daf2e360f31bd3857ecd18647dd72a82ed0911ea14136703729e168a88e1727a691f22864c1a0d2f0f51f69658daf9e97bb6a2c5425ab9b5f06a45319bc3f2f9a46ff310d343cd2223b7de733b116cbf17e58fdb4383697ff5fba95bd49017bcc0cb59c53d3f2afc7b925820e46d9dc1e9ec13df95cf67a4bee27bb76c4688dba374ada4b9c0b29b3141707845bfc77d0cffd6e80136a068a30836f38011cdec99246ad34c17bd1dc92f313bd904059e54190259274ff466d2aba350e5d3b70aee000d7fe22c4e87c13fdd177c3bddce41cd5ceb74a09fbb5f26a2198d3cb1c846e3b2b4005d37491ec2d6d191a680b749abed4907508d2547bed2c89512b0ccffe967f657c61236b47bd4fc31f7ce58add4dd6c0168138a8aef37dc9c0eaa950fa4e00cc1c9feeba4bda06b6c5d8316f459fd16243a65a919fc1b71e40a7a94d7cf1189ac4ce10e8dc450ef166bde46bd22417bcdb997a98a1a16617aec38d64453c186a4a5f9d43ba0c523e37ee40557bc136a33474195c831e2bc321125ac97ad5591d9b70d7aad1bb73877f5b22bef63f7fc0e68496cf5fa5f74f7fab40dcba8a5bd3b958573f36fe73084f050a38cec1e4089609e709ef84a198d66339ea08c2dde6b424429cb8aa9718abcc119d904743333a8bcb0bbe3c8efa8b53a3bb7e2f5e396bcb637fbdbe9a94421e8e8340e7143ef8871d855889a3f3a42703b9faf96550eb8bdc6f685a35b35dc60f518d223722e8ae8fe24243dce98cf84bf726b86456e38dc8ee57ca1f0d132c33c1ac01a26526a1f6df99dadfa64cd16aeea7075ef893bd1333973204ed0dc59bf10c9312d5a123b277033efa2bf2dffb939a1833496a03e1677a37f9339a56f26e0563dd69a0ca96b73512b4e0456f94e2579436084407750e6bfc73b962cfba063397397eb936dfde4f24c52fc69ee569ae274cb40db8a6d23d36e9a8663bacbf35a84e940a5157b6e9dcbbbc09cad106ee6b25c7fb35c1a02f6192e872b281d8bb46bc2aed2e7020b464216b81398658d87a82ef4e544eef12c5c0daf6f32463a8ecaf71a3625594032ce69ba120d810d9fe2be5aaca63b0786c473433fe1c554a109bda5021f907299d5892eece74ef62652069e7d12aa3e023cb909769dc68ccf57fae50ef33bb487952e2d83fb091fcd741b848ab43e30cf6f3ea1e5845f5ad7ba7c3f176118f20b3cb66180a959a878bf88f36d48efa34530219a8e85ad8d160e849caa2bc905af801ba1e33a7ecac062ffa099f74e2913bc97ab876ceda8228f689beaea914d0230ab4511c0d27074c320e3cda1fbc134e163bedbafab79db5d4184d78515883935e887be3afe1fb4e1288f397a501b34c0ae3aa5a104cd8250e5a3c148254ce5b24c40acd7bfcbe045457abb4d951dc27fb90b6a3f87c88583b7963e5139e951a05308637dfdefe04b068c9fa918c92762535a0bb59a6e2cdf6b1ef91d443451a052da77dd825181807400e92bea1a1c0b6046f006c1526a5985af5b2dcd8e06f2e46f44b155a882b2edb69c46ee169e30da4f156c2f18911063a3f66209c6ca0fa9811220230ff12dc835fddd589e95677193c175c22bcceaee12dc6c6d14e013c8f01e4df819135b7cbc79391145a6a0524e651f553fe5e7b469bf07f0ebd60e2064c136575d1d1219a46c1e23046e5100889ed0d19ca1a21e321ff5122fb1d7a090bd94e84dfc10f4e2c3eefdb907cd6e8df6e41a545c8a7c3539a5eda14682c40533f3c67e11e2d5261b122ee4132149783b4d3af93e7831d8e7b831876a157b22f9c1d9693c50c49221ac750d57ec26b7c22f705873c98caba21a18b594e322ef071c248020885f1e7b13203b4d80277d03946836bd442e47e8eb37315d32c374de569349fa984e6af34a1ffaea14a153a18bebe4727acc23dbf58620e508ebec5d9779cffb506b104a3269908b3e52e962d774c518aed2ca548d50f2731f965d7b106ce87ed3896b2587ab6f509a1d3f8ee4dac7700d418bb0b5ed98dbd5cdd6496e3f22b3006b3f1efe37c05b15b006e921902f179a52300585102f4025b28032f778495c2a968b7a0f98575fd2712f166b22fe5b81ad9e0d8cf3ad39236f51c875aedbb65c2a152c87cf015ede2d4b71209be90d797ec010ac603114bf665a390ebeafbc5e5cfe79e37a6668ced356d2a53bb5c77ed59b183634ae423f73e5f1c14e253a9c59c626f2364c76431dc7900be9a7d0062c2167a05f05ed99c0d454c25f497c02bee9957d09f9b1173d2eb3651e19cdb12f8cbc2d33719b3d1d05d09f7acc3078076ccdf4bfae833962f6a1f706a5af666e652d8e66bb30dd18cac7e529f6458dafbcf63fa86cfdd36587633d63d6410382e599f315b161340961f0e48c5c7a5dc4ddd19ecc8cc9b525e3427987d03317a361a227c402cf0496c2260d31815cdfcf4f0e5e23a697b1b874f6f42345344a3d73f8e723796a28c3907c0f84365ad83e26d81ed19a4d8b71d4711db494c26bc5ea1d1c73a60f7f43ef82c97db8fb271deade34b0cf821548052a0baa6051da917bf48b122b3e095f91ebbaf338c5bc60988a16f03c7cb0cd6aca0c16aaafb6d1926c13947dce3a4850bb5789fa89a62c4733968473273612fc218fbb9ec1addaa6a1c605730e2d3937ef8ccf5b6991445038313a8b5dc1f4e03441f8ee95bc24a987e5aa5391a5286912c678262e0f85ea784dc9b33b575a1b5f301be63a74d598a82d71069ec14743ddf7865e6f8f6e752fb9edffc60388abecdcc8ffd74781a0d358bfb194b4a1827abc4882209f28ed940bb74f4022edf9999bd249302faa23dd5e5096c52e0f338562dca118bdb562faa35774138868517557d6f4439c63eedcc5b7ad701a61bb43b04068942dabe4e854ddcebbc0852c1013f895534d582370ee64f1f435967afda354078ae7650c8a8ce272feb03975fc0db94eba735b6e247dc32960eb0295df79e8cd07dacbfe193b14f25bfc86ba715640977408663df394c799338d914c0ae03e78fd1eac548a1c2d6e42e1840cdd2b4296da3e2d5d876ce07dcbd1a7e6a18266328bee834a9bbd322096af6db975fc6d492d5a30ec8ad853b74dfc2bafdebf7997e9f95d6a15b127221ddbeffaa9fc10530f9e1c2aa3632a883de309594a67a8f877deb34f95920642ebf6ab437a8062f8e98f04557cfac6e82d58ecb5dec39218d7e0eba16286cb4e6a2bb67370e8391ea59aa34f551055b9a81de9583502b45152087a358da852806295fda434ca807480378f4d0bad56acd35182ac3942945475229d67819394fca3acaa8c6f20e88952c75a5df4ae064d9bc140b68580431427f89a338df61810b5d1bf73b2940daa39cdc5e81a8de224729eec0883ee0f3cbf92f24472a4634aae7c92bb57b44090528e99a0df9c476b78a1736fc7d06307523ad7b77377a95c2d983b71f3b82d16e85d81ef5d303a015bde002811fff7f7ef5aa164830f4c7aee60f84d3e9a5d3b45c4a0ff311b25354f5713df8778587ae454ee545bddee884a32c43e9a42553db59b873b343fe698e81460be09f2a790076f797da345ae023f87744be5faa9cc8cad7893cfd48c690fb26f936af746a9ae1310d20843101bbc31c8d634fe018b98d4a84e8d4d5ae635041878607d4da113a8252359c3fd97cfc14b1c480c8bc58420467bc6d22a5a2ab2e02fef4bc20047072a55014b221ad60313b50d5c7587b18ae776f944a3882b178d0324f3fca1d8e4b1ae3df75c9de4f7cafd1b7b84628a18b56333d695578044f68f5eacbccb78b89b242dc20e461bb1166f7c811f1d7bada8fb3437a109472f2d1beadb8534f1b45b9b2b722296fee198717e51976bff559894f84ba980087fac022e7c125a59f1182a1b5f896717d363f00ac90e32b911b275c13b5bba59f11966c10075e02c39e523f867607c4755cdd6bb773cd5ea385c0456f7fdfbfe6b36520a5e9293c6e9178e45f6f6a945fead18907b4a5647ca3eb33632cb4dffc68a133dddf778694c233de1949045dde14792f9c275363018fea11e20ab2aefbb7629dfda2463a56fc2a90191209586e02651182969679bea577f655604cb37bf5b49b7c1adc7902bc0751e4bc5061d29bbc1cda4677cd86831bc5b94a42fef67a4043fb0cff985278037f6c8d239042ad165b047350e93d3168fd33310aa075c679cf0c095461615e036f14c4756db07a3e0aff786be01b69d75280d979434eaea1b5f8e8e56fdf29a0a395c9557fc9a3b03b76e0d64e9f391f8c762cb01088a432ac06ed1616d91c825ed6b98885295630c1eee175d3dae2943533368bb5b477ddfd5b26e2b2f8b9cdf14a371eb5cf6b974ec6899d75767e949a96b2c460058dd3590e8f62eab361f9a9125bb167fc3042556921bad14f187577dc72c79593d9f5185a1527da6aa95a1e7cc22ebb263075b2489a6b1101e03917d8dfb2f48f57491485ed2187bacbd5fc27572c1fcff969047b84d469b387a4dc27831fa0a35a21c3f1b467b25fe8b8a80592b73f03b83ec10cb76531acba346092123fdece45ac1b173487c16bd2817dbf54de6ad1b1175f8654847d1fd8cda7a95d5736d680ac7d3ac985ea3b364da6d84ab7c8cffe70696e4f1186fb355cde1cfb3159cf32a99af733a851d8517bfbbd6a9e6b21ffac0abe08b4d0f168cfd5c8e74dfb880b14de8a4230811984954b576c9669cf3b8fc316c1e6e80c720952abd23796b08f9e7f1fec3f3c9709104a832d3431a6348e8fe9f1bb0405dace1d6ecdf1408992ac526cb7347e6fa1580bede4473ce27135ac9c1763db502afec99e4c72157e8b612bab71c6d9b28ac49887437402ef50d050d92b41ae2ba5ff3928ec371878713d36d3e31", 0x1000}], 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="d80000000000000029000000050000009bdeb4527693239fa9aa2c841b2f666462c6352e1cc3dc74a4d82ab7a9dd123572ea1bdbe3666d3c8e6edfc084a60964c936a52dd8729173aa253f9bf29c292ad86c3b2871c6d46fc06f12b39be3300327b766de7640efeb4c95b308b7406d58dbe0e481cd583314ebf2cc80b0431abbea804126a263f04c7e4aa4e450e75c6060456f6225beaf0e71624d0afe51870f188bbfc31b601ad25af1bf151f14a60bb05600000000886300007334dcce5d8e0956d00088410982994c6e7531aa6ba548b43d29b1f60f3d"], 0xd8, 0x14801}, {&(0x7f0000000400)={0x27, 0x1, 0x1, 0x1, 0x7, 0x3f, "696688eb46a81916f4230ecc174c7ba44e3d3131f82129c58776cd18367f37c289eb6de63f3ac76ef232d359ff9e52a37dd0bd33578f23ccff03e0a1bd843c", 0x36}, 0x60, &(0x7f0000000480)=[{&(0x7f0000000280)="3e4569f3b2b64e6f525ff0199b85a4d6671c14f22dbaf842e336f56db9b1f59b9a2e0a4e2861988a", 0x28}, {&(0x7f0000003600)="e040b22dcc558fb44fc888f8a0efcac6131f1752b8f123330cddcd05d8238a7cf60ec997fd388da6fc7cd732cfb5e8b329a5d5b1123f40bb2390848132fe1a242f105ae7fbc81d3ae9e11d0f9ece06df27c04e2eb25bb98eecd7463b4a3f64f3de7d8e3693734937562aa66d6eeae70b81b2843b2c10f84fa13e4758e366881b8887f7d59be1f4293c09b401bdfce32adef861acdc6051d335d9d0d240bd9ad5d268819a3f60d56d10b36fe7fad0155e6b3eee6f1f35497c4008da8168e610f666691487f5ab57b11085d71611ef175e8dc7522845980f08ebb43b7e878749c189e16515f9f1da241e462949710ffc", 0xef}], 0x2, &(0x7f0000003700)=ANY=[@ANYBLOB="900000000000000081000000ff000000a0fb8a1399ef06af12b47be3c9906e354f94da48e3f98eaaa9adc70160440cdaf21722bb027e67325c151f6b1a21a0a55dddb58480ffea4c50840b11358a12bcfefd4ffd04ea58b1c640e97bdfbda38bd4f6194606884044d9cb97d299e238c14f4e05eb2db44cbfef8ebd63c6322a00"/144], 0x90, 0x2004a801}], 0x2, 0x800) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = accept4$tipc(0xffffffffffffffff, &(0x7f00000037c0)=@name, &(0x7f0000003800)=0x10, 0x800) sendmsg$sock(r1, &(0x7f0000004c00)={0x0, 0x0, &(0x7f0000004b00)=[{&(0x7f0000003840)="55f9b1909e401756503e4b72379772d735d336ecccc4b5502f60844543a9bae2792400e1ab4fdcd758819cebd2c6139a705e4a95d1dda14a4545b1e86949bd4640563af2c04dbd422583bfe73a39fd95144e8014e4155272c7d335fa58b070371827f8af4d766949013de85e0136ca4da3dd8df2916c01670309246fc9b160709c5eca27ae46c8dccb55d52874d5a7d50a8179184b498850ce4c16bc71f36d7ea148e5d822f3e5dfd3861d2cce71ee00e9a45f8e5064d52c184c30c4111fbcf0e781dc67d11095dc579ad506457105", 0xcf}, {&(0x7f0000003940)="9baf307d9f0d4b6bc82220e81657ee778e1779cc7a0317285f158ef5c54da2f63d8e8849864f69d3a224fc90bf280ddfe6e805c6375061a93ba132734ed551f03811660b51cbc538381c889602b0c6a4f36c364805bd2bb1c96a56390f24f60119ac385c5f62ae6f928c033053daec99a3e2a5d9c85585c3cc39322bd29fab564f2ccde56c036c6ef5cfe444569a4cca59bbdec75f73bb46a8eb8266cf9599a72fcabc679b9356c943af6dba056b13fc14be1157c57d08ff933709b9b8108250d9adf13eb5fe2b5f301e0b6e64527fb7497b788f566243e66ed1beef5a9fdab76751f343938a3db03c6415dc619dc187a61740efe0e6b0984c1b1161a4c8011d0cee24d00de4da5c842db70cb2ef466a603e3b0574b95452f40866fab3ae2a8759c6d8c81b7fee44dcacd47e8482b16829687ad244c3e160dee2ba2b2a12531af768900ad796db288ab9c87f70bbdd8ed87e5b48b14f25fd7114b12cff3e12cc256f45fb18d539dab6a3a71ce430c6a39539f67e123047d687f86d33dc85e4744e95e41b6a9f50695b6ab69efb27985de7ed6ce43bbc42b7e12c66561c8b6e82b6268094188ed4408ceb953c4949b99a88da19993ef414f3b51575805576c95d91e69bb2a20ac2bae8fd80c7fff966bd439afbae80da81ea476a57090378a1ffcc2d91ca011e3578e1c7812e2773c7d366b5c75c8d95c8250e3d9bdf2a057a4e7937834156e3efd40815cc71d14026cc44ba35ecacd83aaf84f9035fe2bc70c082ab88c35543066a0e66fcd47855f60f5f7cbabda8ee060c70ab1dc27e6d2710f77acc4ffe5c101124ef02771c12942f82c97826e72f30b02ed02ace4bfb5d783e08fbfb56fdbbee1f92fdc784eeb6a1e39e3cbffe2ffe99f045996d69872703321d837dcd7b04eafb84892c5cea65ca5c535b1c6bcc488b0b8dde04734d18d06f4df9bdb000f57bd369c36807e23061efed6f865243409daae225a4603f4ad347c13778fbed63a77fb846c95a41106d3f37c0630727cd8ff41a295366aa50b6e9107f67b2ed4977ba2bafada44f43fabaabf5f03ebd64dd64632e51c3c11af69d231d62f0e45e0cd57cf8a14b3d018f0c8b8f49bf5ee3830b12ce85825490007935f8eaead8386ace906767b16174b93bfa3bdf269929743bcc555673530c5e6052bf4e48e69f437186877f603ff4cd283769ac36aff45c2c3651a63f1e2fa01ea699860bc18cb5dee6dddcbd9165beb7790d70b4aa4faff6868cb076ae751068bb67583fed74da45c5c31eef1af0506cacf0c740afdce2ccb5afb33faf045c33ed5e33b347f5d344d30d4ebf50dbf04fca96ab0cd5fd66908596c3a71aaf55d134e8885b8c1ef74152ff0ad526e2e00d3e4049a943c4eb9feceb224f3eb65e0324532a02589028f9aab8247bfe0837a455f5bb24f4a52aa32082cb3913d2fa213a3f0e7f13fdf0c9f9a0779b7d5ba3d1b6bc5c5704d713214afc4d17159a9376a83d32538219cb818cdace7ee811d49b75e479c46cc280d4259a6be0526041e7ccc53dfd5c110a3cbdfb7cca3b26731427ae4de3110cad800c66b184db8e6e05ac79bf902683fd72f9a823e666ea735a5392465f457111aee145c0992e51e869403d63b3ba155d15f25a04066dbdd48c22790f4746f9e5856388428c162be8ca39fcee2351c001d1ce2cccc5d3de8626ac144663e4f724a46fa1584a1dc91af94bc5eda8c7c41df88d4d1ab15dbc92f40ef3e7b859250f3cdbbf6892fc2a15fd90bb0ec5ad2dc06f2819470cb40913b15f41bef74ae39cb6d8af2c7293cf77859d13a5bb196f799367898aae6974c1e790c19252bfb1a8d3ee9e01b6e551a365092fb749bbab57cb6713578f2782daca360b455921110de5aadf4078ce9ffae41bdc96660ee37cab84d33eba234c1becddbd04fa6139756e6a0fbe3de531c496328a9f31421de12978adb1ee856b9bf995f5391e74a98f10417f2a77776764a9523d7d1e98af3fa11548f6210ee78de3a51f63fcdc2f512a6b49ce5812cb1e274c71c2f5e6896a6c0de2e88180e4541f34e6329e18aded3722746ceaf573fd2cbf331f07ef99d60a824c5feab0db819407bb7a98f777baa3843ec3c8266d244e5b6633d42c346ad400f9af83834d97c1ed58fcbda18ffa761fdc58f710113d011092f406ed1e286fc3266f7d4e841f411c49207bb97f00fe292a30a45dbf46f6d0191c1e70b6f3fbd2f9732899c55ee1a653d8fa0ea74b44b78a6296458586ff1d600e9dea4a0bb79ecf5a3f80064350dad6008b0b38879d2d4f0c518d1d6e562ceb3c17f851036f0ee1aa3c9989027b528ee2a309553f2b26c6c5c68919e14337c749bb383f2a1cea0ffe13884b02d98dcb02eae01884653b802848824fcf59a8e21cbf0ee76b0e25e814097f86e046d69955d301940a77d2be67c310efe90099f37658211520e7df455ad3d569cd50bf059264790047b75042e58d3c9845c1d16a6e34ad558dadfe89443086fbfa47c76bad79ce12bace5c4285c6af6b18d0bedc7b4d7ea361c8a3eca22bd69637e91556f5d8fe11c297111b718c47687d6a0709f1e83fd6788d4b44db8e61f0b355eab7d176437ff2cebb3b8b7053afc3ef9db4198628ce17745dff96169f5837e540dc5859818700e466cb41ee0ff88ce1647f911afb85ccee26b8fe76c64f05fe17be3dfbc9a024f20d0f98908d3dee0caa0ad89d4f6021a63f7d55ed4963e3174f7c216bcd4524d5fb2a88cdb283301db6243210cd5dc408397a3b4c959d3cac17addc7df98455d61ee426f93b431c12d175cb97f1e2bd822584aded2fabe97ef5d212ea02b12661670abdd23a3912208e3d232b14b8a15d004664f474c97ceae035664b64fe80f9f7cce157fca42247b88a619403397ec7b144c406aa038b4cb6f17a93fb6bda843d0fd7979fd3c3f71d345de471d41c44e370052168c8fc842581a2e95ffa7afccb0e0d02fc853e0fbb1d8bfdaaae54f3c86abe0fbeea71b1479972ba1622443750b5f6a727dd59487835e24577a9f6c40ad54990722e39a82a84fa4a99fb83f619565c5c350c45d51733ddaeb2bc9cf6eb81383256ec1e945f8304e6449aa4d930a2139b73cf6201785d1a0cb6d9fdc2a5566a08d3f6d30af4b6af3e4955fbf25845cbc96903f3699753c5d5cffdf364b7c821c0823ebf6fa0b318d4ec300ee449eb4b360610ef20463f8e4a2a2dcd1070651d451d3d13a0ec91270444981eddde288fe644442325ccfcf57432d00da5e20bd560dedcebf8e10d5d62280db050861808d4f6940324402d4a9ca91c53bac998e3ac006d2382fdaf98d6e5b98b6c87c9fd41baae8aceee94b64f3eeda778860f3f93fdf6cd067b69975a0f647cb0354e316d7ad6ba2f8dc2e7f05d77eae723f2e1cc3e5fc76f9e6e0de1563a4008e07c6290f8ef9841b21c6c3a211288cf3af5e5bd4ce9622f8de9aa202da58b573177f28be119dbbc4978092db45c0e01d8c7b9b3f4abb4a3ded0b69b93b7bd638ee74479015fd8388985d1abc3164321aa57bb91186e020a28d54f8e76f4ef01745059affd714a6979785168350ed74e629ed8949aea273e9c68aa5b904e02c83bf932d0c84d5bc9c41ea2f46208a157581a75258380f03ad2a97aeff888a62b8a080411a4faefbc6daca44f45e590d6d534053880df13f9f653184c4dd07dbac4866a1ee6138db1bf21dbad8f87168cb2ebbe720b36986a0355e01b4dbee79f4467673b381f3d8591dcfd9a938d2c2df5f955db70052370200856e35c38fb28f7fa8a809f0156e4a3fc537fb5737f2478e59dca59f474bec25405cc349b0f53de48f7e1438bf81e4d19e654cf829854c2f086b07552cb2355bb331f4ff9935fb7cf6ee1914ef32cd8c1152e448a7bc839d777b6a73a0802bc84d06ba7470c5d7806b3f09e5e441a3e0583014b12ebdb82ac82af9b1c06a9ed7e5f9503d9e708f0753a4c63fdec9f9bb67460358d11a71ea50205c79c584f80745deb495efafa9c23e3de2876ea888e977e49ececed5ef4abc8874f636a906f8681917f54cad9c1206a0c486fff5938849e42791ae0ee1fe2cc875bfab37942e7261f46ad65f4b542d102b62e5b6567f9ca13eb5b64c9aa1ac8451723181e93ee3f25a743deb246fecd4b6f732a639e6aa400ffaff2c5c0daa78aedc38453943cd3383941df06ed76275879e3c3625379a444badc1395631ddbf4d810927487e473f6b94c32cda3f35e01872f8259e53dab91973ae0b651989bac4058bd919ae6a26c6885925b449b676fa63f7bba1f29bef17d2f1647525dc400da018ed103e826b1a6d6691d52743764c977d84f22f7ab13f212dbbfd0a9292ef718a0ca7052520817f2f1a08e631e03659fd4e1d5512020018d7fa45158b5fc4d2b81125ddd26f53ddced61ae4d5bc5f899cde409c0efb6a057a22c789ab505f76fad9cc1e3e02e917ce31ce751b295d5b6c37898e4db8828e705bd0f2a675483a7692e0fe1e8c39c9287efd1af2b6c4007e086cb383d850b3819b4e64c364d2b826d20b6b6b7f2d07d6ab64c2af88d9e7b7544746fe962bf4fcd92f2abe8338e124ec6b83394f102a17b58fdca58141416962450857f0684e57928c6f8cece06aaa0a2613c2008c99262d8b1dc193bae963c608ded6657dfe7a90a41e266c1641afe3e0f24f6f28d8c83f48f493e088cd31fdbeaea3cf5333f2b2b0dd924adb6949a2e0b5517fb0d8571928f3e8aba7cea45798c8580979293bb2a77051ac53d6da29166a5bcc7670eeaf7ab0549545a9146bf17e1df720728b7700e31fcf6e1fe43ba636856f290875f92a2b2e61902e30f4952364415bca32402c1e95779322d0643ecf5d025e622e2a2e1f20890cb6d2ff7c68e2bd5af89f17b9b9a367bcfaa974f0d4dcabdd9d511dad451587ebd2adca5a554f8310cb16b8a9918b2548851f5b72b9a8f2f10244482d4c3ae9f61ea78b5c08246804d676a2573c51070382d35291290ab27496397c02694443e42310e3e0d063c20b7bc5823b2586607fe32ead09c60269f98bfee9780693adfa5277d51b7b368b1cfa121e7116b3e17191f47a7c05de0f641660cce1e6bdaacdd38ed806bb7e7ae36ed3bc32b2aebca12397ce05f2ef2e81c24efffc6df75c005b928c1bb259739f67e553c5570062356e9634aa73e92864870450ae44595c56dba4e66b20f7c48046b47303ccbe0dd31a3ae7f9ba53e5c08ad43b265e0edbc19070fdb950c16d2b366c733fa97ef56bc4d7f8dd4ec8369b29deaa0c8f6602e149c8fa010fc046a147c028a7589564fee6ac69e88868389adefcd53dc4bae880b4bca8e9c0723b71716e153ac3c183146cb188797a846e212d4573cd49e31507718b300625015b65f63177e0c5ce26fc1af51c4f5c5f80d9d2273a44eabe6058273775f3f86c3e5ef6651e043699cc9f2f3ee35844ca56b524af91fb26a80532daf43982c406465dbbb8ed3c6ed3ae1567ddb4ebc8cbfb14199c5ed9f446699614f990acec586d2cfc62f30e22ca0d9da03f838e5b11724c67a73e586947992f675c54e34e433c6c5739c53e409f34c5a08e85abcc90a89cd76fed66ec6865cc8771c3a051b3cd0efc3d7bab87fa62a2abb98768151d47ee09d5e723844ec4ae7020c976eb45e8a92690df8d1c5ed422d5857f20966ee94f2740fa43c5ba25933fdb419d4cc9b3f2cd1f18e3d33c5e0b6118fb6836d2c0adaf9b8c246b5cce49e76c2de16c37ef56b044ff2d70a1a01fb0f67c04e2c0eef8c713eeccf65db9f999e55", 0x1000}, {&(0x7f0000004940)="f604be09ac0cbd01ff6e56782ba2f9ceb5d40933e826a3f208feb36aa9aeb8cbccf2d2bd6f6ce4c2dab88062d95628d767adc8737bb4670b2c7c1264bce954f9ac776d99bc7845064b65cc4c1f366bf4651f92be5eb09a1c0c46005855b0eb4e62e7c5e8628450c5ab92b23e1c85ab15db752cd141bbbfbeb5d08447885311a3774077093a2a015a91999645577c69f70459f5dec39d992d40ace4537c549b198bcbfc36dab3e33e6842334b4db4d5013aa7fbd874f13e678b5afc7bbe090186aff3003aa44b701d39d4fce17d50be1328a4ec6f84576f2af0dfe8c5ed24c3993fdf71a12db359350b88311e03", 0xed}, {&(0x7f0000004a40)="2d309256a418e937392e9e8aaf78bc5297236c8efbb37526b5ca0a603cde7d9d77a3f48b5c88586b890aba2006c8aa1d86cdeaea879463bc234fc9cbf14157feaedfc72afa440b161351d034633ba73e8ec611dff18811497aee2c6429b2ae4d074999e13d0a232c0bced844ab5fbc2fd95485e39ea21937e6fe39ee8dd9fc91b9b531bf0714eed018d941f6d648c6107bb631baa508a9f9a0", 0x99}], 0x4, &(0x7f0000004b40)=[@mark={{0x14, 0x1, 0x24, 0x3}}, @mark={{0x14, 0x1, 0x24, 0x6}}, @mark={{0x14, 0x1, 0x24, 0x7}}, @txtime={{0x18, 0x1, 0x3d, 0x6}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x400}}], 0x90}, 0x40) fadvise64(r0, 0x0, 0x0, 0x4) 01:30:43 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:43 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "00000000000000000000000000000000000006"}) 01:30:43 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:43 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1494.558693][ T307] tipc: TX() has been purged, node left! 01:30:43 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a'}) 01:30:43 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:43 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0b") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:43 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b'}) 01:30:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xc7, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:44 executing program 5: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0x4, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0xffffffffffffff81}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r0, &(0x7f00000015c0), 0x10000005c) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3, 0x8003) write$UHID_DESTROY(r1, &(0x7f0000000040), 0x4) fadvise64(r0, 0x0, 0x0, 0x4) [ 1496.398199][ C0] net_ratelimit: 19 callbacks suppressed [ 1496.398208][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1496.409728][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1496.468200][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1496.474041][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1496.479934][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1496.485706][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1497.588254][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1497.588289][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1497.594075][ C1] protocol 88fb is buggy, dev hsr_slave_1 01:30:46 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) 01:30:46 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0b") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:46 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00>'}) 01:30:46 executing program 0: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x10001, 0x1, &(0x7f0000000580)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) chdir(&(0x7f0000000180)='./file0\x00') r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x434002, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f0000000040)={0x8000, 0x7, 0x4}) r1 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f00000015c0), 0x10000005c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fadvise64(r1, 0x0, 0x0, 0x4) 01:30:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000923000)='/dev/snd/seq\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f00000001c0)={{0x80}, 'por\xff\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\xff\xff\xff\x03\x00\x00\x00\xef\x00\x00\x03\xff\x02\x00\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x0, 0x80003}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00004d1ff0)='/dev/sequencer2\x00', 0x1, 0x0) close(r0) close(r1) 01:30:46 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?'}) 01:30:46 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0b") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) 01:30:46 executing program 1: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000140), 0x10) setsockopt(r1, 0x65, 0x1, &(0x7f0000000080), 0x1d0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, 0x0) syz_open_dev$dri(0x0, 0x0, 0x0) close(r1) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, &(0x7f0000000040)) [ 1498.185030][T15632] attempt to access beyond end of device 01:30:47 executing program 4: r0 = socket$inet6(0xa, 0x80003, 0x6b) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0805b5055e0bcfe847") pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400ad", 0x7}], 0x1) write$binfmt_elf64(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="efbfd8cff5d9d4468a10"], 0xa) close(r3) socket$netlink(0x10, 0x3, 0x4) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfef0) splice(r1, 0x0, r3, 0x0, 0x80000001, 0x0) [ 1498.228347][T15632] loop0: rw=1, want=130, limit=128 01:30:47 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@'}) [ 1498.267950][T15632] buffer_io_error: 6 callbacks suppressed [ 1498.268021][T15632] Buffer I/O error on dev loop0, logical block 129, lost async page write 01:30:47 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r0, 0x5412, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, "000000000000000000000000000000fffffdfd"}) [ 1498.362908][T15632] attempt to access beyond end of device [ 1498.388153][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1498.416242][T15632] loop0: rw=1, want=131, limit=128 [ 1498.450808][T15632] Buffer I/O error on dev loop0, logical block 130, lost async page write [ 1498.508503][T15632] attempt to access beyond end of device [ 1498.537346][T15632] loop0: rw=1, want=132, limit=128 [ 1498.557666][T15632] Buffer I/O error on dev loop0, logical block 131, lost async page write [ 1498.579836][T15632] attempt to access beyond end of device [ 1498.602518][T15632] loop0: rw=1, want=133, limit=128 [ 1498.614821][T15632] Buffer I/O error on dev loop0, logical block 132, lost async page write [ 1498.639032][T15632] attempt to access beyond end of device [ 1498.652262][T15632] loop0: rw=1, want=142, limit=128 [ 1498.668772][T15632] Buffer I/O error on dev loop0, logical block 141, lost async page write [ 1498.677684][T15632] attempt to access beyond end of device [ 1498.688666][T15632] loop0: rw=1, want=143, limit=128 [ 1498.702622][T15632] Buffer I/O error on dev loop0, logical block 142, lost async page write [ 1498.719900][T15632] attempt to access beyond end of device [ 1498.732289][T15632] loop0: rw=1, want=144, limit=128 [ 1498.737816][T15632] Buffer I/O error on dev loop0, logical block 143, lost async page write [ 1498.755143][T15632] attempt to access beyond end of device [ 1498.761576][T15632] loop0: rw=1, want=145, limit=128 [ 1498.767106][T15632] Buffer I/O error on dev loop0, logical block 144, lost async page write [ 1498.795540][T15632] attempt to access beyond end of device [ 1498.802148][T15632] loop0: rw=1, want=4161, limit=128 [ 1498.872232][T15632] attempt to access beyond end of device [ 1498.877973][T15632] loop0: rw=1, want=11769, limit=128 [ 1498.897228][T15620] attempt to access beyond end of device [ 1498.904703][T15620] loop0: rw=2049, want=12049, limit=128 [ 1501.748208][ C1] net_ratelimit: 19 callbacks suppressed [ 1501.748217][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1501.748247][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1501.753906][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1502.548192][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1502.553983][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1502.628209][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1502.633982][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1502.708267][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1502.714181][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1502.720060][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1506.788225][ C0] net_ratelimit: 19 callbacks suppressed [ 1506.793936][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1506.799697][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1506.878221][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1506.884001][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1506.889894][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1506.895671][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1507.988191][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1507.988208][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1507.994005][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1507.999732][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1512.148236][ C0] net_ratelimit: 20 callbacks suppressed [ 1512.148245][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1512.148262][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1512.153964][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1512.159882][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1512.948220][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1512.954416][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1513.028241][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1513.036703][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1513.108287][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1513.114360][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1517.188196][ C0] net_ratelimit: 20 callbacks suppressed [ 1517.193902][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1517.199693][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1517.268238][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1517.274044][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1517.279895][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1517.285707][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1518.388220][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1518.388228][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1518.388279][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1518.394017][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1522.548187][ C1] net_ratelimit: 20 callbacks suppressed [ 1522.548213][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1522.553876][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1522.559659][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1522.565292][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1523.348210][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1523.354024][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1523.428180][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1523.433986][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1523.508266][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1523.514099][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1527.588248][ C0] net_ratelimit: 19 callbacks suppressed [ 1527.588254][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1527.599732][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1527.668254][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1527.674096][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1527.679919][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1527.685690][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1528.788209][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1528.788238][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1528.793998][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1529.588198][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1532.948178][ C1] net_ratelimit: 19 callbacks suppressed [ 1532.948194][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1532.958238][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1532.959640][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1532.965311][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1533.758172][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1533.763968][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1533.828188][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1533.834006][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1533.908253][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1533.914096][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1537.988220][ C0] net_ratelimit: 20 callbacks suppressed [ 1537.993913][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1537.999675][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1538.068265][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1538.068323][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1538.068452][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1538.085674][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1539.188217][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1539.188223][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1539.188295][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1539.194021][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1543.348212][ C1] net_ratelimit: 20 callbacks suppressed [ 1543.348248][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1543.353891][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1543.365340][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1544.158165][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1544.163955][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1544.228201][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1544.233983][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1544.308243][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1544.314054][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1544.319915][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1548.388184][ C0] net_ratelimit: 19 callbacks suppressed [ 1548.388190][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1548.399656][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1548.468261][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1548.474134][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1548.479993][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1548.485763][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1549.588199][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1549.588244][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1549.593988][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1549.599727][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1553.748199][ C1] net_ratelimit: 20 callbacks suppressed [ 1553.748205][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1553.758184][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1553.759653][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1553.765315][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1554.548170][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1554.553983][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1554.628227][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1554.633985][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1554.708218][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1554.713991][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1558.788183][ C0] net_ratelimit: 20 callbacks suppressed [ 1558.788191][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1558.799707][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1558.868221][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1558.874034][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1558.879964][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1558.885719][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1559.988183][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1559.993954][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1559.998178][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1560.005429][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1564.148169][ C1] net_ratelimit: 20 callbacks suppressed [ 1564.148177][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1564.148222][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1564.153876][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1564.159617][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1564.948147][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1564.953961][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1565.028214][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1565.034034][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1565.108238][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1565.114055][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1569.188186][ C0] net_ratelimit: 20 callbacks suppressed [ 1569.188192][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1569.199769][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1569.268262][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1569.274107][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1569.280021][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1569.285790][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1570.388207][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1570.388214][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1570.388288][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1570.394012][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1574.548180][ C0] net_ratelimit: 20 callbacks suppressed [ 1574.548215][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1574.553870][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1574.565329][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1575.348201][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1575.353988][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1575.428165][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1575.433943][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1575.508210][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1575.514006][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1575.519916][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1579.588259][ C0] net_ratelimit: 19 callbacks suppressed [ 1579.588266][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1579.599919][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1579.668265][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1579.674079][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1579.679960][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1579.685738][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1580.788210][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1580.788216][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1580.788271][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1580.794040][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1584.948185][ C1] net_ratelimit: 20 callbacks suppressed [ 1584.948243][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1584.953873][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1584.959648][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1584.965333][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1585.748186][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1585.754011][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1585.828173][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1585.833946][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1585.908216][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1585.913993][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1589.988227][ C0] net_ratelimit: 20 callbacks suppressed [ 1589.993925][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1589.999744][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1590.068282][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1590.074102][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1590.080006][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1590.085808][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1591.188219][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1591.188225][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1591.188265][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1591.194100][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1595.348187][ C1] net_ratelimit: 20 callbacks suppressed [ 1595.348196][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1595.348202][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1595.348252][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1595.353902][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1596.148174][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1596.154005][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1596.228172][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1596.233966][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1596.308259][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1596.314078][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1600.388219][ C0] net_ratelimit: 20 callbacks suppressed [ 1600.388287][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1600.399742][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1600.468252][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1600.468309][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1600.468419][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1600.485620][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1601.588261][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1601.588266][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1601.588344][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1601.594077][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1605.748191][ C1] net_ratelimit: 20 callbacks suppressed [ 1605.748197][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1605.758210][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1605.759639][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1605.765399][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1606.548191][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1606.554030][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1606.628213][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1606.634003][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1606.708260][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1606.714086][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1610.788213][ C0] net_ratelimit: 20 callbacks suppressed [ 1610.793886][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1610.799624][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1610.868301][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1610.874135][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1610.879974][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1610.885737][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1611.988203][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1611.988223][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1611.994045][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1611.999761][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1616.148182][ C1] net_ratelimit: 20 callbacks suppressed [ 1616.148191][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1616.148197][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1616.148247][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1616.153896][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1616.948184][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1616.953961][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1617.028186][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1617.034115][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1617.108267][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1617.114096][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1621.198150][ C0] net_ratelimit: 20 callbacks suppressed [ 1621.198157][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1621.209605][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1621.268264][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1621.274070][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1621.280012][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1621.285776][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1622.388205][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1622.388215][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1622.388281][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1622.394003][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1626.548208][ C1] net_ratelimit: 20 callbacks suppressed [ 1626.548220][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1626.548271][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1626.553891][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1626.571028][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1627.358173][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1627.364024][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1627.428206][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1627.434932][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1627.508231][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1627.514041][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1631.588210][ C0] net_ratelimit: 20 callbacks suppressed [ 1631.588216][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1631.599646][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1631.668239][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1631.674074][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1631.679978][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1631.685740][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1632.788196][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1632.794001][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1632.798184][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1632.805474][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1636.948191][ C0] net_ratelimit: 20 callbacks suppressed [ 1636.948200][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1636.948224][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1636.953901][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1637.748168][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1637.753939][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1637.828206][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1637.833994][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1637.908231][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1637.908322][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1637.919929][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1641.988243][ C0] net_ratelimit: 19 callbacks suppressed [ 1641.988250][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1641.999878][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1642.068258][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1642.074202][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1642.080087][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1642.085886][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1643.188216][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1643.188224][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1643.188298][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1643.194003][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1647.348184][ C1] net_ratelimit: 20 callbacks suppressed [ 1647.348192][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1647.348239][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1647.353992][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1647.359730][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1648.158178][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1648.163991][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1648.228238][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1648.234016][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1648.308246][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1648.314054][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1652.388213][ C0] net_ratelimit: 20 callbacks suppressed [ 1652.388222][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1652.399837][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1652.468273][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1652.474120][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1652.480001][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1652.485786][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1653.588234][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 1653.594027][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 1653.598203][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 1653.605485][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 1655.758356][ T1045] INFO: task syz-executor.5:15605 blocked for more than 143 seconds. [ 1655.766461][ T1045] Not tainted 5.5.0-rc3-syzkaller #0 [ 1655.772428][ T1045] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1655.781674][ T1045] syz-executor.5 D26664 15605 10077 0x00004004 [ 1655.788004][ T1045] Call Trace: [ 1655.791378][ T1045] __schedule+0x934/0x1f90 [ 1655.795801][ T1045] ? __sched_text_start+0x8/0x8 [ 1655.800747][ T1045] ? _raw_spin_unlock_irq+0x23/0x80 [ 1655.805954][ T1045] ? wait_on_page_bit+0x23f/0xa60 [ 1655.811044][ T1045] ? _raw_spin_unlock_irq+0x23/0x80 [ 1655.816246][ T1045] schedule+0xdc/0x2b0 [ 1655.820386][ T1045] io_schedule+0x1c/0x70 [ 1655.824650][ T1045] wait_on_page_bit+0x27c/0xa60 [ 1655.829562][ T1045] ? __lock_page_killable+0xb30/0xb30 [ 1655.834953][ T1045] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1655.841150][ T1045] ? page_cache_prev_miss+0x340/0x340 [ 1655.846524][ T1045] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1655.852105][ T1045] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 1655.858154][ T1045] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1655.864412][ T1045] ? page_mapping+0x301/0x5c0 [ 1655.869131][ T1045] wait_on_page_writeback+0x1b2/0x4f0 [ 1655.874499][ T1045] __filemap_fdatawait_range+0x145/0x340 [ 1655.880209][ T1045] ? add_page_wait_queue+0x260/0x260 [ 1655.885497][ T1045] ? __filemap_fdatawrite_range+0x1fc/0x3b0 [ 1655.892293][ T1045] ? find_held_lock+0x35/0x130 [ 1655.897065][ T1045] ? generic_file_write_iter+0x42b/0x68e [ 1655.902752][ T1045] file_write_and_wait_range+0x1ac/0x210 [ 1655.908680][ T1045] __generic_file_fsync+0x79/0x200 [ 1655.913804][ T1045] fat_file_fsync+0x78/0x210 [ 1655.918458][ T1045] ? fat_free_clusters.cold+0x2f/0x2f [ 1655.923843][ T1045] vfs_fsync_range+0x141/0x230 [ 1655.928665][ T1045] generic_file_write_iter+0x4ea/0x68e [ 1655.934127][ T1045] ? __generic_file_write_iter+0x630/0x630 [ 1655.939995][ T1045] ? __kasan_check_read+0x11/0x20 [ 1655.945033][ T1045] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1655.951305][ T1045] ? iov_iter_init+0xee/0x220 [ 1655.956000][ T1045] new_sync_write+0x4d3/0x770 [ 1655.960738][ T1045] ? new_sync_read+0x800/0x800 [ 1655.965609][ T1045] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1655.971858][ T1045] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 1655.977164][ T1045] __vfs_write+0xe1/0x110 [ 1655.981558][ T1045] vfs_write+0x268/0x5d0 [ 1655.985803][ T1045] ksys_write+0x14f/0x290 [ 1655.990189][ T1045] ? __ia32_sys_read+0xb0/0xb0 [ 1655.994955][ T1045] ? do_syscall_64+0x26/0x790 [ 1656.000549][ T1045] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1656.006644][ T1045] ? do_syscall_64+0x26/0x790 [ 1656.011361][ T1045] __x64_sys_write+0x73/0xb0 [ 1656.015954][ T1045] do_syscall_64+0xfa/0x790 [ 1656.020523][ T1045] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1656.026409][ T1045] RIP: 0033:0x45a919 [ 1656.030372][ T1045] Code: 48 01 de 48 29 d9 e8 56 f8 ff ff 48 8b ac 24 00 80 00 00 48 81 c4 08 80 00 00 c3 e8 41 f6 ff ff e9 4c ff ff ff 48 8d bc 24 10 <80> 00 00 48 39 3b 75 8c 48 89 23 eb 87 cc cc cc cc cc cc cc cc cc [ 1656.050038][ T1045] RSP: 002b:00007f34f2892c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1656.058508][ T1045] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919 [ 1656.066476][ T1045] RDX: 000000010000005c RSI: 00000000200015c0 RDI: 0000000000000003 [ 1656.074496][ T1045] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 1656.082496][ T1045] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f34f28936d4 [ 1656.090528][ T1045] R13: 00000000004cbd0a R14: 00000000004e5aa0 R15: 00000000ffffffff [ 1656.098570][ T1045] INFO: task syz-executor.5:15611 blocked for more than 143 seconds. [ 1656.106652][ T1045] Not tainted 5.5.0-rc3-syzkaller #0 [ 1656.113178][ T1045] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1656.122387][ T1045] syz-executor.5 D27088 15611 10077 0x00004004 [ 1656.128816][ T1045] Call Trace: [ 1656.132120][ T1045] __schedule+0x934/0x1f90 [ 1656.136524][ T1045] ? __sched_text_start+0x8/0x8 [ 1656.141449][ T1045] ? _raw_spin_unlock_irq+0x23/0x80 [ 1656.148867][ T1045] ? wait_on_page_bit+0x23f/0xa60 [ 1656.153901][ T1045] ? _raw_spin_unlock_irq+0x23/0x80 [ 1656.159177][ T1045] schedule+0xdc/0x2b0 [ 1656.163250][ T1045] io_schedule+0x1c/0x70 [ 1656.167491][ T1045] wait_on_page_bit+0x27c/0xa60 [ 1656.172506][ T1045] ? __lock_page_killable+0xb30/0xb30 [ 1656.177896][ T1045] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1656.184130][ T1045] ? page_cache_prev_miss+0x340/0x340 [ 1656.189573][ T1045] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1656.195116][ T1045] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 1656.201144][ T1045] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1656.207407][ T1045] ? page_mapping+0x301/0x5c0 [ 1656.212139][ T1045] wait_on_page_writeback+0x1b2/0x4f0 [ 1656.217533][ T1045] __filemap_fdatawait_range+0x145/0x340 [ 1656.223790][ T1045] ? __kasan_check_read+0x11/0x20 [ 1656.228894][ T1045] ? add_page_wait_queue+0x260/0x260 [ 1656.234176][ T1045] ? wbc_attach_and_unlock_inode+0x612/0x9d0 [ 1656.240211][ T1045] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1656.246475][ T1045] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 1656.252135][ T1045] filemap_fdatawait_range+0x26/0x40 [ 1656.257430][ T1045] __writeback_single_inode+0x969/0x1400 [ 1656.263139][ T1045] ? _raw_spin_unlock+0x28/0x40 [ 1656.267994][ T1045] writeback_single_inode+0x2cf/0x440 [ 1656.273421][ T1045] sync_inode_metadata+0xa8/0xe0 [ 1656.278408][ T1045] ? sync_inode+0x30/0x30 [ 1656.282740][ T1045] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1656.289050][ T1045] __generic_file_fsync+0x169/0x200 [ 1656.294266][ T1045] fat_file_fsync+0x78/0x210 [ 1656.298956][ T1045] ? fat_free_clusters.cold+0x2f/0x2f [ 1656.304515][ T1045] vfs_fsync_range+0x141/0x230 [ 1656.309365][ T1045] generic_file_write_iter+0x4ea/0x68e [ 1656.314906][ T1045] ? __generic_file_write_iter+0x630/0x630 [ 1656.320788][ T1045] ? __kasan_check_read+0x11/0x20 [ 1656.325934][ T1045] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1656.332977][ T1045] ? iov_iter_init+0xee/0x220 [ 1656.337647][ T1045] new_sync_write+0x4d3/0x770 [ 1656.342372][ T1045] ? new_sync_read+0x800/0x800 [ 1656.347159][ T1045] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1656.353376][ T1045] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 1656.358733][ T1045] __vfs_write+0xe1/0x110 [ 1656.363061][ T1045] vfs_write+0x268/0x5d0 [ 1656.367299][ T1045] ksys_write+0x14f/0x290 [ 1656.371707][ T1045] ? __ia32_sys_read+0xb0/0xb0 [ 1656.376473][ T1045] ? do_syscall_64+0x26/0x790 [ 1656.381199][ T1045] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1656.387270][ T1045] ? do_syscall_64+0x26/0x790 [ 1656.392010][ T1045] __x64_sys_write+0x73/0xb0 [ 1656.396650][ T1045] do_syscall_64+0xfa/0x790 [ 1656.401208][ T1045] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1656.407117][ T1045] RIP: 0033:0x45a919 [ 1656.411102][ T1045] Code: 48 01 de 48 29 d9 e8 56 f8 ff ff 48 8b ac 24 00 80 00 00 48 81 c4 08 80 00 00 c3 e8 41 f6 ff ff e9 4c ff ff ff 48 8d bc 24 10 <80> 00 00 48 39 3b 75 8c 48 89 23 eb 87 cc cc cc cc cc cc cc cc cc [ 1656.430757][ T1045] RSP: 002b:00007f34f282fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1656.440221][ T1045] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045a919 [ 1656.448262][ T1045] RDX: 000000010000005c RSI: 00000000200015c0 RDI: 0000000000000004 [ 1656.456237][ T1045] RBP: 000000000075c118 R08: 0000000000000000 R09: 0000000000000000 [ 1656.464310][ T1045] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f34f28306d4 [ 1656.472536][ T1045] R13: 00000000004cbd0a R14: 00000000004e5aa0 R15: 00000000ffffffff [ 1656.480633][ T1045] [ 1656.480633][ T1045] Showing all locks held in the system: [ 1656.488532][ T1045] 3 locks held by kworker/u4:2/102: [ 1656.493724][ T1045] #0: ffff8880ae837358 (&rq->lock){-.-.}, at: __schedule+0x232/0x1f90 [ 1656.502064][ T1045] #1: ffffffff899a5680 (rcu_read_lock){....}, at: __update_idle_core+0x45/0x3f0 [ 1656.511304][ T1045] #2: ffff8880ae827258 (&base->lock){-.-.}, at: lock_timer_base+0x56/0x1b0 [ 1656.520040][ T1045] 2 locks held by kworker/u4:3/223: [ 1656.525289][ T1045] #0: ffff88821ad78128 ((wq_completion)writeback){+.+.}, at: process_one_work+0x88b/0x1740 [ 1656.535595][ T1045] #1: ffffc900012b7dc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}, at: process_one_work+0x8c1/0x1740 [ 1656.547181][ T1045] 1 lock held by khungtaskd/1045: [ 1656.553705][ T1045] #0: ffffffff899a5680 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x279 [ 1656.563096][ T1045] 2 locks held by getty/10030: [ 1656.567995][ T1045] #0: ffff8880a3044090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1656.576990][ T1045] #1: ffffc9000176b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 1656.586682][ T1045] 2 locks held by getty/10031: [ 1656.591506][ T1045] #0: ffff888099f86090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1656.601441][ T1045] #1: ffffc9000175b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 1656.611210][ T1045] 2 locks held by getty/10032: [ 1656.615969][ T1045] #0: ffff8880976f2090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1656.624989][ T1045] #1: ffffc9000174b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 1656.634594][ T1045] 2 locks held by getty/10033: [ 1656.639435][ T1045] #0: ffff8880a2202090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1656.648439][ T1045] #1: ffffc900016fb2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 1656.658006][ T1045] 2 locks held by getty/10034: [ 1656.663407][ T1045] #0: ffff8880a0398090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1656.672477][ T1045] #1: ffffc9000177b2e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 1656.682086][ T1045] 2 locks held by getty/10035: [ 1656.686826][ T1045] #0: ffff888215797090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1656.695814][ T1045] #1: ffffc900011102e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 1656.705438][ T1045] 2 locks held by getty/15628: [ 1656.710267][ T1045] #0: ffff8880a6b4c090 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 [ 1656.721516][ T1045] #1: ffffc90000e902e0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x220/0x1bf0 [ 1656.731165][ T1045] 2 locks held by syz-executor.5/15605: [ 1656.736712][ T1045] #0: ffff88809f5788e0 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 [ 1656.745345][ T1045] #1: ffff88806f894428 (sb_writers#13){.+.+}, at: vfs_write+0x485/0x5d0 [ 1656.753958][ T1045] 3 locks held by syz-executor.5/15611: [ 1656.759566][ T1045] #0: ffff888054358b60 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 [ 1656.769067][ T1045] #1: ffff88806f894428 (sb_writers#13){.+.+}, at: vfs_write+0x485/0x5d0 [ 1656.777500][ T1045] #2: ffff888045570c70 (&sb->s_type->i_mutex_key#22){++++}, at: __generic_file_fsync+0xb5/0x200 [ 1656.788110][ T1045] [ 1656.790443][ T1045] ============================================= [ 1656.790443][ T1045] [ 1656.798892][ T1045] NMI backtrace for cpu 1 [ 1656.803243][ T1045] CPU: 1 PID: 1045 Comm: khungtaskd Not tainted 5.5.0-rc3-syzkaller #0 [ 1656.811459][ T1045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1656.821500][ T1045] Call Trace: [ 1656.824804][ T1045] dump_stack+0x197/0x210 [ 1656.829116][ T1045] nmi_cpu_backtrace.cold+0x70/0xb2 [ 1656.834381][ T1045] ? vprintk_func+0x86/0x189 [ 1656.839054][ T1045] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 1656.844677][ T1045] nmi_trigger_cpumask_backtrace+0x23b/0x28b [ 1656.850656][ T1045] arch_trigger_cpumask_backtrace+0x14/0x20 [ 1656.856536][ T1045] watchdog+0xb11/0x10c0 [ 1656.861243][ T1045] kthread+0x361/0x430 [ 1656.865308][ T1045] ? reset_hung_task_detector+0x30/0x30 [ 1656.870839][ T1045] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 1656.876554][ T1045] ret_from_fork+0x24/0x30 [ 1656.881128][ T1045] Sending NMI from CPU 1 to CPUs 0: [ 1656.886535][ C0] NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0xe/0x10 [ 1656.888299][ T1045] Kernel panic - not syncing: hung_task: blocked tasks [ 1656.901629][ T1045] CPU: 1 PID: 1045 Comm: khungtaskd Not tainted 5.5.0-rc3-syzkaller #0 [ 1656.909861][ T1045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1656.919956][ T1045] Call Trace: [ 1656.923243][ T1045] dump_stack+0x197/0x210 [ 1656.927563][ T1045] panic+0x2e3/0x75c [ 1656.931439][ T1045] ? add_taint.cold+0x16/0x16 [ 1656.936095][ T1045] ? lapic_can_unplug_cpu.cold+0x3a/0x3a [ 1656.941713][ T1045] ? ___preempt_schedule+0x16/0x18 [ 1656.946808][ T1045] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 1656.952958][ T1045] ? nmi_trigger_cpumask_backtrace+0x24c/0x28b [ 1656.959092][ T1045] ? nmi_trigger_cpumask_backtrace+0x256/0x28b [ 1656.965240][ T1045] ? nmi_trigger_cpumask_backtrace+0x21b/0x28b [ 1656.971381][ T1045] watchdog+0xb22/0x10c0 [ 1656.975616][ T1045] kthread+0x361/0x430 [ 1656.979670][ T1045] ? reset_hung_task_detector+0x30/0x30 [ 1656.985197][ T1045] ? kthread_mod_delayed_work+0x1f0/0x1f0 [ 1656.990900][ T1045] ret_from_fork+0x24/0x30 [ 1656.996665][ T1045] Kernel Offset: disabled [ 1657.000998][ T1045] Rebooting in 86400 seconds..