, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x15, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2065.478309][ C1] sd 0:0:1:0: tag#1593 CDB[20]: ba [ 2065.490406][T28524] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x37, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:03 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000bc0306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2065.574124][T28524] loop5: detected capacity change from 0 to 4 [ 2065.590099][T28524] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2065.640460][ C1] sd 0:0:1:0: tag#1575 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2065.643301][T28551] loop0: detected capacity change from 0 to 512 [ 2065.650329][ C1] sd 0:0:1:0: tag#1575 CDB: opcode=0xe5 (vendor) [ 2065.663012][ C1] sd 0:0:1:0: tag#1575 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2065.666234][ C0] sd 0:0:1:0: tag#1576 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2065.672043][ C1] sd 0:0:1:0: tag#1575 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 17:22:03 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2b, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:03 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000801800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2065.681826][ C0] sd 0:0:1:0: tag#1576 CDB: opcode=0xe5 (vendor) [ 2065.690833][ C1] sd 0:0:1:0: tag#1575 CDB[20]: ba [ 2065.697147][ C0] sd 0:0:1:0: tag#1576 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2065.711311][ C0] sd 0:0:1:0: tag#1576 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2065.720356][ C0] sd 0:0:1:0: tag#1576 CDB[20]: ba 17:22:03 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x16, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2065.788405][T28551] EXT4-fs (loop0): bad geometry: block count 62652544 exceeds size of device (128 blocks) [ 2065.796330][T28563] loop5: detected capacity change from 0 to 4 17:22:03 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000c80306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x38, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:03 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000ca0306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2065.890221][T28563] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2065.914797][ C1] sd 0:0:1:0: tag#1589 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2065.921067][ C0] sd 0:0:1:0: tag#1590 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2065.924665][ C1] sd 0:0:1:0: tag#1589 CDB: opcode=0xe5 (vendor) [ 2065.934477][ C0] sd 0:0:1:0: tag#1590 CDB: opcode=0xe5 (vendor) [ 2065.940779][ C1] sd 0:0:1:0: tag#1589 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2065.947094][ C0] sd 0:0:1:0: tag#1590 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2065.947110][ C0] sd 0:0:1:0: tag#1590 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2065.956104][ C1] sd 0:0:1:0: tag#1589 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2065.956128][ C1] sd 0:0:1:0: tag#1589 CDB[20]: ba [ 2065.965126][ C0] sd 0:0:1:0: tag#1590 CDB[20]: ba 17:22:03 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x37, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:03 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x22000000}]) 17:22:03 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x17, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2066.095201][T28563] loop5: detected capacity change from 0 to 4 [ 2066.109745][T28563] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2066.132651][T28591] loop0: detected capacity change from 0 to 512 17:22:03 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000901800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2066.157128][T28591] EXT4-fs (loop0): bad geometry: block count 63570048 exceeds size of device (128 blocks) [ 2066.244068][T28608] loop5: detected capacity change from 0 to 4 [ 2066.253329][T28591] loop0: detected capacity change from 0 to 512 [ 2066.270137][T28591] EXT4-fs (loop0): bad geometry: block count 63570048 exceeds size of device (128 blocks) 17:22:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x39, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:03 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x3f000000}]) 17:22:03 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x18, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2066.296062][T28608] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2066.334390][T28608] loop5: detected capacity change from 0 to 4 17:22:03 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000ce0306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2066.369067][T28608] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:04 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000a01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2066.417911][T28633] loop0: detected capacity change from 0 to 512 17:22:04 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x40000000}]) [ 2066.467686][T28633] EXT4-fs (loop0): bad geometry: block count 63832192 exceeds size of device (128 blocks) 17:22:04 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3a, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2066.524699][T28646] loop5: detected capacity change from 0 to 4 [ 2066.543286][T28633] loop0: detected capacity change from 0 to 512 [ 2066.551510][T28646] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x19, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2066.568297][T28633] EXT4-fs (loop0): bad geometry: block count 63832192 exceeds size of device (128 blocks) 17:22:04 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x35, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:04 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000b01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2066.614891][T28646] loop5: detected capacity change from 0 to 4 [ 2066.628611][T28646] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:04 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000ed0306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2066.735105][T28683] loop5: detected capacity change from 0 to 4 [ 2066.751284][T28684] loop0: detected capacity change from 0 to 512 17:22:04 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xe4ffffff}]) 17:22:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1a, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2066.788052][T28683] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2066.820554][T28684] EXT4-fs (loop0): bad geometry: block count 65863808 exceeds size of device (128 blocks) [ 2066.903701][T28684] loop0: detected capacity change from 0 to 512 [ 2066.910311][T28683] loop5: detected capacity change from 0 to 4 [ 2066.924889][T28684] EXT4-fs (loop0): bad geometry: block count 65863808 exceeds size of device (128 blocks) [ 2066.935743][T28683] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:04 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x28, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:04 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000c01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:04 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xf4ffffff}]) 17:22:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1b, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:04 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000f20306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:04 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3b, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2067.063213][T28721] loop5: detected capacity change from 0 to 4 [ 2067.120806][T28721] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2067.133387][T28734] loop0: detected capacity change from 0 to 512 17:22:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1c, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2067.173979][T28734] EXT4-fs (loop0): bad geometry: block count 66191488 exceeds size of device (128 blocks) 17:22:04 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xfbffffff}]) [ 2067.219925][T28721] loop5: detected capacity change from 0 to 4 [ 2067.236169][T28734] loop0: detected capacity change from 0 to 512 [ 2067.251108][T28721] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2067.265006][T28734] EXT4-fs (loop0): bad geometry: block count 66191488 exceeds size of device (128 blocks) 17:22:04 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x1300, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:04 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000f40306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:04 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000d01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:05 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3c, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:05 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1d, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2067.394686][T28766] loop0: detected capacity change from 0 to 512 [ 2067.397451][T28768] loop5: detected capacity change from 0 to 4 [ 2067.418884][T28768] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:05 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xfeffffff}]) [ 2067.438051][T28766] EXT4-fs (loop0): bad geometry: block count 66322560 exceeds size of device (128 blocks) [ 2067.467570][T28768] loop5: detected capacity change from 0 to 4 [ 2067.474530][T28768] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2067.487935][T28766] loop0: detected capacity change from 0 to 512 [ 2067.495774][T28766] EXT4-fs (loop0): bad geometry: block count 66322560 exceeds size of device (128 blocks) 17:22:05 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000e01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:05 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) (fail_nth: 1) 17:22:05 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000fa0306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2067.603981][T28801] loop5: detected capacity change from 0 to 4 [ 2067.626428][T28801] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2067.647386][T28806] loop0: detected capacity change from 0 to 512 17:22:05 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3d, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:05 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xff010000}]) 17:22:05 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1e, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2067.651078][T28807] FAULT_INJECTION: forcing a failure. [ 2067.651078][T28807] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2067.666795][T28807] CPU: 0 PID: 28807 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2067.676948][T28807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2067.687006][T28807] Call Trace: [ 2067.690278][T28807] dump_stack_lvl+0xd6/0x122 [ 2067.694871][T28807] dump_stack+0x11/0x1b [ 2067.699025][T28807] should_fail+0x23c/0x250 [ 2067.703436][T28807] should_fail_usercopy+0x16/0x20 [ 2067.708489][T28807] _copy_from_user+0x1c/0xd0 [ 2067.713078][T28807] get_timespec64+0x45/0xe0 [ 2067.717573][T28807] __se_sys_ppoll+0x76/0x1d0 [ 2067.722181][T28807] ? fput+0x2d/0x130 [ 2067.726104][T28807] __x64_sys_ppoll+0x63/0x70 [ 2067.730732][T28807] do_syscall_64+0x44/0xa0 [ 2067.735443][T28807] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2067.741384][T28807] RIP: 0033:0x7f704a8e28d9 [ 2067.745782][T28807] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2067.765388][T28807] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 2067.773787][T28807] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2067.781743][T28807] RDX: 0000000020000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 2067.789702][T28807] RBP: 00007f704865a1d0 R08: 0000000000000008 R09: 0000000000000000 17:22:05 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) (fail_nth: 2) [ 2067.797732][T28807] R10: 0000000020000440 R11: 0000000000000246 R12: 0000000000000001 [ 2067.805690][T28807] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2067.814601][T28806] EXT4-fs (loop0): bad geometry: block count 66715776 exceeds size of device (128 blocks) [ 2067.828888][T28801] loop5: detected capacity change from 0 to 4 [ 2067.843321][T28801] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:05 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000001001800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2067.895977][T28806] loop0: detected capacity change from 0 to 512 [ 2067.914353][T28806] EXT4-fs (loop0): bad geometry: block count 66715776 exceeds size of device (128 blocks) [ 2067.937921][T28824] FAULT_INJECTION: forcing a failure. [ 2067.937921][T28824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2067.951108][T28824] CPU: 1 PID: 28824 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2067.955616][T28840] loop5: detected capacity change from 0 to 4 [ 2067.961253][T28824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2067.961267][T28824] Call Trace: [ 2067.961274][T28824] dump_stack_lvl+0xd6/0x122 [ 2067.985194][T28824] dump_stack+0x11/0x1b [ 2067.989342][T28824] should_fail+0x23c/0x250 [ 2067.993791][T28824] should_fail_usercopy+0x16/0x20 [ 2067.998976][T28824] _copy_from_user+0x1c/0xd0 [ 2068.003552][T28824] set_user_sigmask+0x53/0x130 [ 2068.008389][T28824] __se_sys_ppoll+0x15f/0x1d0 [ 2068.013087][T28824] __x64_sys_ppoll+0x63/0x70 [ 2068.017765][T28824] do_syscall_64+0x44/0xa0 [ 2068.022430][T28824] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2068.028313][T28824] RIP: 0033:0x7f704a8e28d9 [ 2068.032746][T28824] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2068.052337][T28824] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 2068.060735][T28824] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2068.068728][T28824] RDX: 0000000020000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 2068.076681][T28824] RBP: 00007f704865a1d0 R08: 0000000000000008 R09: 0000000000000000 [ 2068.084636][T28824] R10: 0000000020000440 R11: 0000000000000246 R12: 0000000000000001 [ 2068.092591][T28824] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 17:22:05 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x21, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:05 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) (fail_nth: 3) [ 2068.129661][T28840] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2068.173422][T28852] FAULT_INJECTION: forcing a failure. [ 2068.173422][T28852] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2068.186551][T28852] CPU: 1 PID: 28852 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2068.196699][T28852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2068.206753][T28852] Call Trace: [ 2068.210022][T28852] dump_stack_lvl+0xd6/0x122 [ 2068.214615][T28852] dump_stack+0x11/0x1b [ 2068.218823][T28852] should_fail+0x23c/0x250 [ 2068.223271][T28852] should_fail_usercopy+0x16/0x20 [ 2068.228295][T28852] _copy_to_user+0x1c/0x90 [ 2068.231813][T28840] loop5: detected capacity change from 0 to 4 [ 2068.232801][T28852] put_timespec64+0x51/0x90 [ 2068.243353][T28852] poll_select_finish+0x2ff/0x3f0 [ 2068.248402][T28852] __se_sys_ppoll+0x19f/0x1d0 [ 2068.253073][T28852] __x64_sys_ppoll+0x63/0x70 [ 2068.257653][T28852] do_syscall_64+0x44/0xa0 [ 2068.262059][T28852] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2068.267950][T28852] RIP: 0033:0x7f704a8e28d9 [ 2068.272439][T28852] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2068.292031][T28852] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 2068.300494][T28852] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2068.308469][T28852] RDX: 0000000020000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 2068.316425][T28852] RBP: 00007f704865a1d0 R08: 0000000000000008 R09: 0000000000000000 17:22:05 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000020406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:05 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xff0f0000}]) 17:22:05 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) (fail_nth: 4) 17:22:06 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000001101800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2068.324377][T28852] R10: 0000000020000440 R11: 0000000000000246 R12: 0000000000000001 [ 2068.332408][T28852] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2068.348048][T28840] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:06 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3e, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2068.408945][T28864] FAULT_INJECTION: forcing a failure. [ 2068.408945][T28864] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2068.422122][T28864] CPU: 1 PID: 28864 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2068.432420][T28864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2068.442474][T28864] Call Trace: [ 2068.445748][T28864] dump_stack_lvl+0xd6/0x122 [ 2068.450342][T28864] dump_stack+0x11/0x1b [ 2068.454519][T28864] should_fail+0x23c/0x250 [ 2068.459014][T28864] should_fail_usercopy+0x16/0x20 [ 2068.464046][T28864] _copy_from_user+0x1c/0xd0 [ 2068.468709][T28864] get_timespec64+0x45/0xe0 [ 2068.473248][T28864] __se_sys_ppoll+0x76/0x1d0 [ 2068.477841][T28864] __x64_sys_ppoll+0x63/0x70 [ 2068.482430][T28864] do_syscall_64+0x44/0xa0 [ 2068.486876][T28864] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2068.492776][T28864] RIP: 0033:0x7f704a8e28d9 [ 2068.497185][T28864] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2068.516839][T28864] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 2068.525256][T28864] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2068.533264][T28864] RDX: 0000000020000200 RSI: 0000000000000000 RDI: 0000000000000000 [ 2068.541231][T28864] RBP: 00007f704865a1d0 R08: 0000000000000008 R09: 0000000000000000 [ 2068.549197][T28864] R10: 0000000020000440 R11: 0000000000000246 R12: 0000000000000001 17:22:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x22, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2068.557166][T28864] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 17:22:06 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) (fail_nth: 5) [ 2068.622043][T28880] loop0: detected capacity change from 0 to 512 [ 2068.644647][T28883] loop5: detected capacity change from 0 to 4 [ 2068.668045][T28883] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2068.672742][T28880] EXT4-fs (loop0): bad geometry: block count 67240064 exceeds size of device (128 blocks) [ 2068.695970][T28889] FAULT_INJECTION: forcing a failure. [ 2068.695970][T28889] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2068.709126][T28889] CPU: 1 PID: 28889 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 17:22:06 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xff600000}]) [ 2068.719358][T28889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2068.729414][T28889] Call Trace: [ 2068.732725][T28889] dump_stack_lvl+0xd6/0x122 [ 2068.737322][T28889] dump_stack+0x11/0x1b [ 2068.741475][T28889] should_fail+0x23c/0x250 [ 2068.746013][T28889] should_fail_usercopy+0x16/0x20 [ 2068.751037][T28889] _copy_from_user+0x1c/0xd0 [ 2068.755635][T28889] kstrtouint_from_user+0x7e/0x170 [ 2068.760751][T28889] ? 0xffffffff81000000 [ 2068.764900][T28889] ? proc_fail_nth_read+0x150/0x150 [ 2068.770097][T28889] proc_fail_nth_write+0x4b/0x150 [ 2068.775174][T28889] vfs_write+0x286/0x900 [ 2068.779419][T28889] ? vfs_read+0x4e3/0x750 [ 2068.783748][T28889] ? poll_select_finish+0x3a5/0x3f0 [ 2068.788943][T28889] ? __fget_light+0x21b/0x260 [ 2068.793786][T28889] ? __cond_resched+0x11/0x40 [ 2068.798469][T28889] ksys_write+0xd9/0x190 [ 2068.802736][T28889] __x64_sys_write+0x3e/0x50 [ 2068.807442][T28889] do_syscall_64+0x44/0xa0 [ 2068.811840][T28889] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2068.817741][T28889] RIP: 0033:0x7f704a8953ef 17:22:06 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000001201800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2068.822136][T28889] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 2068.841729][T28889] RSP: 002b:00007f704865a170 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2068.850169][T28889] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f704a8953ef [ 2068.858178][T28889] RDX: 0000000000000001 RSI: 00007f704865a1e0 RDI: 0000000000000004 17:22:06 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2068.866163][T28889] RBP: 00007f704865a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2068.874135][T28889] R10: 0000000020000440 R11: 0000000000000293 R12: 0000000000000001 [ 2068.882098][T28889] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 17:22:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x23, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2068.923224][T28880] loop0: detected capacity change from 0 to 512 [ 2068.929685][T28900] loop5: detected capacity change from 0 to 4 [ 2068.938046][T28880] EXT4-fs (loop0): bad geometry: block count 67240064 exceeds size of device (128 blocks) 17:22:06 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000060406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:06 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:06 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000001801800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2068.967140][T28900] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:06 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x1e, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:06 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xffefffff}]) [ 2069.010160][T28919] loop0: detected capacity change from 0 to 512 17:22:06 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x64, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2069.058130][T28919] EXT4-fs (loop0): bad geometry: block count 67502208 exceeds size of device (128 blocks) [ 2069.079335][T28931] loop5: detected capacity change from 0 to 4 [ 2069.098499][T28931] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2069.142715][T28919] loop0: detected capacity change from 0 to 512 [ 2069.163324][T28931] loop5: detected capacity change from 0 to 4 [ 2069.170809][T28919] EXT4-fs (loop0): bad geometry: block count 67502208 exceeds size of device (128 blocks) 17:22:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x24, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:06 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x815, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:06 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000100406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2069.199012][T28931] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:06 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000001c01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:06 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x1508, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2069.293539][T28975] loop0: detected capacity change from 0 to 512 [ 2069.326799][T28979] loop5: detected capacity change from 0 to 4 17:22:06 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xffffefff}]) 17:22:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x25, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2069.340452][T28975] EXT4-fs (loop0): bad geometry: block count 68157568 exceeds size of device (128 blocks) [ 2069.367484][T28979] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:07 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x500, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x1e00, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2069.419683][T28975] loop0: detected capacity change from 0 to 512 [ 2069.427714][T28979] loop5: detected capacity change from 0 to 4 [ 2069.434388][T28975] EXT4-fs (loop0): bad geometry: block count 68157568 exceeds size of device (128 blocks) [ 2069.449108][T28979] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:07 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000002501800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x4000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:07 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000506000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:07 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xffffffe4}]) 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x6400, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:07 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x26, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2069.589156][T29030] loop5: detected capacity change from 0 to 4 [ 2069.603856][T29032] loop0: detected capacity change from 0 to 512 [ 2069.616974][T29030] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x400000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2069.637844][T29032] EXT4-fs (loop0): bad geometry: block count 83886208 exceeds size of device (128 blocks) 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x15080000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2069.681871][T29030] loop5: detected capacity change from 0 to 4 [ 2069.692768][T29032] loop0: detected capacity change from 0 to 512 [ 2069.699210][T29030] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2069.720352][T29032] EXT4-fs (loop0): bad geometry: block count 83886208 exceeds size of device (128 blocks) 17:22:07 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000002601800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:07 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x27, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:07 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x600, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:07 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xfffffff4}]) 17:22:07 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000606000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2069.796095][T29071] loop5: detected capacity change from 0 to 4 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x1e000000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2069.851074][T29071] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2069.881171][T29088] loop0: detected capacity change from 0 to 512 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x64000000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:07 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x28, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:07 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000004801800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2069.912208][T29088] EXT4-fs (loop0): bad geometry: block count 100663424 exceeds size of device (128 blocks) [ 2069.924133][T29071] loop5: detected capacity change from 0 to 4 [ 2069.933654][T29071] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:07 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xfffffffb}]) [ 2069.996635][T29088] loop0: detected capacity change from 0 to 512 [ 2070.027341][T29088] EXT4-fs (loop0): bad geometry: block count 100663424 exceeds size of device (128 blocks) [ 2070.035660][T29118] loop5: detected capacity change from 0 to 4 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0xfefdffff, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2070.065947][T29118] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2070.084901][ C0] scsi_io_completion_action: 29 callbacks suppressed [ 2070.084937][ C0] sd 0:0:1:0: tag#1577 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2070.101488][ C0] sd 0:0:1:0: tag#1577 CDB: opcode=0xe5 (vendor) 17:22:07 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x700, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0xfffffdfe, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2070.107841][ C0] sd 0:0:1:0: tag#1577 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2070.116893][ C0] sd 0:0:1:0: tag#1577 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2070.125962][ C0] sd 0:0:1:0: tag#1577 CDB[20]: ba 17:22:07 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x29, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x7ffffffff000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:07 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000040606000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2070.210343][T29118] loop5: detected capacity change from 0 to 4 [ 2070.230057][T29118] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x1000000000000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:07 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000004c01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:07 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xfffffffe}]) [ 2070.254954][T29161] loop0: detected capacity change from 0 to 512 [ 2070.273794][T29161] EXT4-fs (loop0): bad geometry: block count 100925568 exceeds size of device (128 blocks) [ 2070.290282][ C1] sd 0:0:1:0: tag#1559 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2070.300158][ C1] sd 0:0:1:0: tag#1559 CDB: opcode=0xe5 (vendor) 17:22:07 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x40000000000000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2070.306527][ C1] sd 0:0:1:0: tag#1559 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2070.315575][ C1] sd 0:0:1:0: tag#1559 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2070.324614][ C1] sd 0:0:1:0: tag#1559 CDB[20]: ba [ 2070.360666][ C0] sd 0:0:1:0: tag#1560 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2070.370620][ C0] sd 0:0:1:0: tag#1560 CDB: opcode=0xe5 (vendor) [ 2070.376975][ C0] sd 0:0:1:0: tag#1560 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2070.386127][ C0] sd 0:0:1:0: tag#1560 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2070.395178][ C0] sd 0:0:1:0: tag#1560 CDB[20]: ba 17:22:08 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x900, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:08 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2a, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:08 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0xf0ffffff7f0000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2070.477378][T29161] loop0: detected capacity change from 0 to 512 [ 2070.503219][T29161] EXT4-fs (loop0): bad geometry: block count 100925568 exceeds size of device (128 blocks) [ 2070.531811][T29192] loop5: detected capacity change from 0 to 4 [ 2070.561446][T29192] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2070.567786][ C1] sd 0:0:1:0: tag#1554 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 17:22:08 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x1508000000000000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:08 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000706000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2070.577974][ C1] sd 0:0:1:0: tag#1554 CDB: opcode=0xe5 (vendor) [ 2070.584321][ C1] sd 0:0:1:0: tag#1554 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2070.593358][ C1] sd 0:0:1:0: tag#1554 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2070.602497][ C1] sd 0:0:1:0: tag#1554 CDB[20]: ba [ 2070.638413][ C0] sd 0:0:1:0: tag#1563 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2070.647750][T29209] loop0: detected capacity change from 0 to 512 [ 2070.648287][ C0] sd 0:0:1:0: tag#1563 CDB: opcode=0xe5 (vendor) [ 2070.660844][ C0] sd 0:0:1:0: tag#1563 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2070.662369][T29209] EXT4-fs (loop0): bad geometry: block count 117440640 exceeds size of device (128 blocks) [ 2070.669876][ C0] sd 0:0:1:0: tag#1563 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 17:22:08 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x2000000000}]) [ 2070.669897][ C0] sd 0:0:1:0: tag#1563 CDB[20]: ba [ 2070.704313][T29192] loop5: detected capacity change from 0 to 4 [ 2070.722334][T29209] loop0: detected capacity change from 0 to 512 17:22:08 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2b, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2070.740631][T29192] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2070.752208][T29209] EXT4-fs (loop0): bad geometry: block count 117440640 exceeds size of device (128 blocks) 17:22:08 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x1e00000000000000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:08 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000006801800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:08 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000906000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2070.845873][T29240] loop5: detected capacity change from 0 to 4 [ 2070.866727][T29243] loop0: detected capacity change from 0 to 512 [ 2070.866755][ C0] sd 0:0:1:0: tag#1547 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2070.882822][ C0] sd 0:0:1:0: tag#1547 CDB: opcode=0xe5 (vendor) 17:22:08 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x2100000000}]) 17:22:08 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2c, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2070.882961][T29243] EXT4-fs (loop0): bad geometry: block count 150995072 exceeds size of device (128 blocks) [ 2070.889152][ C0] sd 0:0:1:0: tag#1547 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2070.889173][ C0] sd 0:0:1:0: tag#1547 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2070.917195][ C0] sd 0:0:1:0: tag#1547 CDB[20]: ba [ 2070.932622][T29240] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:08 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xa00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:08 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x6400000000000000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2070.975232][T29243] loop0: detected capacity change from 0 to 512 [ 2070.983223][T29240] loop5: detected capacity change from 0 to 4 [ 2070.992531][T29240] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2071.000688][T29243] EXT4-fs (loop0): bad geometry: block count 150995072 exceeds size of device (128 blocks) 17:22:08 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000a06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:08 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000006c01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2071.089581][T29283] loop0: detected capacity change from 0 to 512 [ 2071.113655][T29287] loop5: detected capacity change from 0 to 4 [ 2071.118808][ C0] sd 0:0:1:0: tag#1589 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2071.129660][ C0] sd 0:0:1:0: tag#1589 CDB: opcode=0xe5 (vendor) [ 2071.131536][T29283] EXT4-fs (loop0): bad geometry: block count 167772288 exceeds size of device (128 blocks) [ 2071.135998][ C0] sd 0:0:1:0: tag#1589 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2071.155057][ C0] sd 0:0:1:0: tag#1589 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2071.158252][T29287] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2071.164103][ C0] sd 0:0:1:0: tag#1589 CDB[20]: ba 17:22:08 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0xfefdffff00000000, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:08 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:08 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xb00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2071.189312][ C1] sd 0:0:1:0: tag#1590 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2071.199182][ C1] sd 0:0:1:0: tag#1590 CDB: opcode=0xe5 (vendor) [ 2071.205609][ C1] sd 0:0:1:0: tag#1590 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2071.214731][ C1] sd 0:0:1:0: tag#1590 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2071.223778][ C1] sd 0:0:1:0: tag#1590 CDB[20]: ba 17:22:08 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x10000000000}]) 17:22:08 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2d, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:08 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000007401800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2071.280899][T29287] loop5: detected capacity change from 0 to 4 [ 2071.290185][T29283] loop0: detected capacity change from 0 to 512 [ 2071.302064][T29283] EXT4-fs (loop0): bad geometry: block count 167772288 exceeds size of device (128 blocks) [ 2071.314565][T29287] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:08 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x1e]}, 0x8) 17:22:09 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000b06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x64]}, 0x8) [ 2071.436797][ C0] sd 0:0:1:0: tag#1572 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2071.446661][ C0] sd 0:0:1:0: tag#1572 CDB: opcode=0xe5 (vendor) [ 2071.453019][ C0] sd 0:0:1:0: tag#1572 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2071.462073][ C0] sd 0:0:1:0: tag#1572 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2071.471119][ C0] sd 0:0:1:0: tag#1572 CDB[20]: ba [ 2071.505708][T29342] loop5: detected capacity change from 0 to 4 [ 2071.512738][T29351] loop0: detected capacity change from 0 to 512 [ 2071.524350][ C0] sd 0:0:1:0: tag#1581 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2071.534206][ C0] sd 0:0:1:0: tag#1581 CDB: opcode=0xe5 (vendor) [ 2071.540546][ C0] sd 0:0:1:0: tag#1581 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x815]}, 0x8) 17:22:09 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xb35, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2071.549602][ C0] sd 0:0:1:0: tag#1581 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2071.558664][ C0] sd 0:0:1:0: tag#1581 CDB[20]: ba 17:22:09 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2e, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x1508]}, 0x8) 17:22:09 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x60ffffffffff}]) [ 2071.629485][T29342] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2071.638226][T29351] EXT4-fs (loop0): bad geometry: block count 184549504 exceeds size of device (128 blocks) 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x1e00]}, 0x8) [ 2071.689693][T29351] loop0: detected capacity change from 0 to 512 [ 2071.696371][T29342] loop5: detected capacity change from 0 to 4 [ 2071.709424][T29342] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2071.716897][T29351] EXT4-fs (loop0): bad geometry: block count 184549504 exceeds size of device (128 blocks) 17:22:09 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000c06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:09 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000007a01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x4000]}, 0x8) 17:22:09 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2f, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:09 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xc00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2071.842285][T29407] loop0: detected capacity change from 0 to 512 [ 2071.842340][T29408] loop5: detected capacity change from 0 to 4 [ 2071.872610][T29407] EXT4-fs (loop0): bad geometry: block count 201326720 exceeds size of device (128 blocks) 17:22:09 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x7fcc507ec000}]) [ 2071.886539][T29408] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x6400]}, 0x8) 17:22:09 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000fe01800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:09 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000d06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:09 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x30, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2072.015573][T29439] loop5: detected capacity change from 0 to 4 [ 2072.038261][T29445] loop0: detected capacity change from 0 to 512 [ 2072.048812][T29439] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x400000]}, 0x8) [ 2072.059165][T29445] EXT4-fs (loop0): bad geometry: block count 218103936 exceeds size of device (128 blocks) 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x15080000]}, 0x8) 17:22:09 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000e06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:09 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x7fcc50c37000}]) [ 2072.102717][T29439] loop5: detected capacity change from 0 to 4 [ 2072.109228][T29445] loop0: detected capacity change from 0 to 512 [ 2072.132096][T29439] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2072.140783][T29445] EXT4-fs (loop0): bad geometry: block count 218103936 exceeds size of device (128 blocks) 17:22:09 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000003800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:09 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x31, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2072.220735][T29480] loop0: detected capacity change from 0 to 512 [ 2072.252973][T29489] loop5: detected capacity change from 0 to 4 17:22:09 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xd00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x1e000000]}, 0x8) [ 2072.264861][T29480] EXT4-fs (loop0): bad geometry: block count 234881152 exceeds size of device (128 blocks) [ 2072.307556][T29489] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2072.328719][T29480] loop0: detected capacity change from 0 to 512 [ 2072.336632][T29489] loop5: detected capacity change from 0 to 4 [ 2072.344254][T29480] EXT4-fs (loop0): bad geometry: block count 234881152 exceeds size of device (128 blocks) 17:22:09 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x7fcc50e37000}]) 17:22:09 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x64000000]}, 0x8) [ 2072.366584][T29489] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:10 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000f06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:10 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000005800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0xfefdffff]}, 0x8) 17:22:10 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x32, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2072.497325][T29533] loop0: detected capacity change from 0 to 512 [ 2072.515588][T29538] loop5: detected capacity change from 0 to 4 17:22:10 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xe00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0xfffffdfe]}, 0x8) 17:22:10 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1000000000000}]) [ 2072.544505][T29533] EXT4-fs (loop0): bad geometry: block count 251658368 exceeds size of device (128 blocks) [ 2072.568337][T29538] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x7ffffffff000]}, 0x8) [ 2072.632250][T29533] loop0: detected capacity change from 0 to 512 [ 2072.640179][T29538] loop5: detected capacity change from 0 to 4 [ 2072.652550][T29538] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2072.659648][T29533] EXT4-fs (loop0): bad geometry: block count 251658368 exceeds size of device (128 blocks) 17:22:10 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000006800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x1000000000000]}, 0x8) 17:22:10 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x2000000000000}]) 17:22:10 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000041006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:10 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x33, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x40000000000000]}, 0x8) [ 2072.794172][T29588] loop5: detected capacity change from 0 to 4 [ 2072.823016][T29588] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2072.831231][T29597] loop0: detected capacity change from 0 to 512 17:22:10 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000201006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2072.851145][T29597] EXT4-fs (loop0): bad geometry: block count 268697728 exceeds size of device (128 blocks) [ 2072.880506][T29588] loop5: detected capacity change from 0 to 4 [ 2072.888338][T29588] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0xf0ffffff7f0000]}, 0x8) 17:22:10 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xf00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:10 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000007800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:10 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x34, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x1508000000000000]}, 0x8) [ 2072.952422][T29620] loop0: detected capacity change from 0 to 512 [ 2072.969425][T29620] EXT4-fs (loop0): bad geometry: block count 270532736 exceeds size of device (128 blocks) 17:22:10 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x8000000000000}]) [ 2073.036568][T29635] loop5: detected capacity change from 0 to 4 [ 2073.053410][T29620] loop0: detected capacity change from 0 to 512 [ 2073.075119][T29620] EXT4-fs (loop0): bad geometry: block count 270532736 exceeds size of device (128 blocks) 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x1e00000000000000]}, 0x8) 17:22:10 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001106000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2073.086309][T29635] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x6400000000000000]}, 0x8) [ 2073.158831][T29635] loop5: detected capacity change from 0 to 4 [ 2073.168017][T29635] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:10 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x35, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:10 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000e800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:10 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x10000000000000}]) [ 2073.202858][T29670] loop0: detected capacity change from 0 to 512 [ 2073.231571][T29670] EXT4-fs (loop0): bad geometry: block count 285212800 exceeds size of device (128 blocks) 17:22:10 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0xfefdffff00000000]}, 0x8) [ 2073.281421][T29684] loop5: detected capacity change from 0 to 4 [ 2073.307867][T29684] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2073.323091][T29670] loop0: detected capacity change from 0 to 512 [ 2073.337997][T29670] EXT4-fs (loop0): bad geometry: block count 285212800 exceeds size of device (128 blocks) 17:22:11 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1100, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:11 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0xffffffffffffffff]}, 0x8) 17:22:11 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x36, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2073.380028][T29684] loop5: detected capacity change from 0 to 4 [ 2073.395554][T29684] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:11 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:11 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000f800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:11 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x20000448) 17:22:11 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x70c350cc7f0000}]) [ 2073.506791][T29727] loop0: detected capacity change from 0 to 512 [ 2073.549847][T29727] EXT4-fs (loop0): bad geometry: block count 301990016 exceeds size of device (128 blocks) [ 2073.565752][T29734] loop5: detected capacity change from 0 to 4 17:22:11 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x37, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2073.599831][T29734] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2073.660781][T29734] loop5: detected capacity change from 0 to 4 [ 2073.661037][T29727] loop0: detected capacity change from 0 to 512 [ 2073.669660][T29734] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:11 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x70e350cc7f0000}]) [ 2073.704302][T29727] EXT4-fs (loop0): bad geometry: block count 301990016 exceeds size of device (128 blocks) 17:22:11 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1200, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:11 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000001b800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:11 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:11 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0xfffffffffffffffe, 0x0}, 0x0) syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0x4000) io_uring_enter(r0, 0x57e1, 0x9704, 0x2, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x4000, 0x84) r3 = syz_io_uring_setup(0x187, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {}, 0x0, {0x0, r6}}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000080)=@IORING_OP_MADVISE={0x19, 0x0, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xe, 0x1}, 0xffff428a) r7 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) r8 = syz_io_uring_setup(0x187, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {}, 0x0, {0x0, r11}}, 0x0) syz_io_uring_submit(r4, r2, &(0x7f00000001c0)=@IORING_OP_SEND={0x1a, 0x5, 0x0, r7, 0x0, &(0x7f00000002c0)="a0a3b5baeb330d00e97ce84ff58b0d32360018c0a38124bfd5d5f489527d456eaf6fb52ac9d9e646ec77806b6bea735458c27cca8bc5f21c6d3965425fd7161b4901d5282d41e5ef4538145d6db7d10f549db34309c0d414420cbfffe456ab403a4499b4331ee58d8352aeece08fa57c44b27df64c8e2cdf214bb469c61fefd82d3a833f4ea7b26ca7896c4effb459b6aee6920e8f35f1bfc714514e35f1ac68549bc83b9b0489e40cbf60d4f1cb7893ce5fc6914889e71e7227d8b57775a229", 0xc0, 0x40, 0x0, {0x0, r11}}, 0xffffff81) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r1, 0x0, &(0x7f0000000380)=@IORING_OP_ASYNC_CANCEL={0xe, 0x5, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, {0x0, r11}}, 0x7fff) ioctl$BTRFS_IOC_TREE_SEARCH(r7, 0xd0009411, &(0x7f0000000480)={{0x0, 0x5, 0x10001, 0x4, 0x80000001, 0x8, 0x1, 0x80000001, 0x3, 0x8f09, 0xffffffff, 0x1, 0x5, 0x1, 0xffff}}) [ 2073.856751][T29776] loop5: detected capacity change from 0 to 4 [ 2073.871086][T29780] loop0: detected capacity change from 0 to 512 17:22:11 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x38, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2073.910222][T29776] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2073.926750][T29780] EXT4-fs (loop0): bad geometry: block count 402653312 exceeds size of device (128 blocks) 17:22:11 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x2, 0x0, 0x1e2}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}, 0x10000) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) io_uring_enter(r4, 0x4b69, 0x2e1d, 0x2, &(0x7f0000000080)={[0x4]}, 0x8) 17:22:11 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xb0030000000000}]) [ 2073.973380][T29776] loop5: detected capacity change from 0 to 4 [ 2073.997596][T29776] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2074.005258][T29780] loop0: detected capacity change from 0 to 512 17:22:11 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000003f800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2074.028115][T29780] EXT4-fs (loop0): bad geometry: block count 402653312 exceeds size of device (128 blocks) 17:22:11 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r0, 0x80286722, &(0x7f00000000c0)={&(0x7f0000000240)=""/74, 0x4a, 0x200, 0x80000000}) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000080)=@IORING_OP_FILES_UPDATE={0x14, 0x2, 0x0, 0x0, 0xffffffff7fffffff, &(0x7f0000000040)=[r0], 0x1, 0x0, 0x1}, 0x200) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:11 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000021906000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:11 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x39, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2074.138499][T29818] loop5: detected capacity change from 0 to 4 [ 2074.175036][T29818] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:11 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xc0030000000000}]) 17:22:11 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2074.214667][T29825] loop0: detected capacity change from 0 to 512 [ 2074.241023][T29818] loop5: detected capacity change from 0 to 4 [ 2074.252111][T29825] EXT4-fs (loop0): bad geometry: block count 419561600 exceeds size of device (128 blocks) [ 2074.271254][T29818] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:11 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000040800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:11 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) io_uring_register$IORING_UNREGISTER_BUFFERS(r4, 0x1, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2074.360858][T29825] loop0: detected capacity change from 0 to 512 [ 2074.367920][T29825] EXT4-fs (loop0): bad geometry: block count 419561600 exceeds size of device (128 blocks) 17:22:12 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001a06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2074.410623][T29863] loop5: detected capacity change from 0 to 4 17:22:12 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3a, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:12 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0, 0x154) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x448000, 0x130) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r6, 0xee00) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r8, 0xee00) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x10832, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@cachetag={'cachetag', 0x3d, '^\''}}, {@aname={'aname', 0x3d, ',+}--,]'}}, {@version_9p2000}], [{@fowner_gt={'fowner>', r6}}, {@subj_role={'subj_role', 0x3d, '\x00'}}, {@uid_eq={'uid', 0x3d, r8}}, {@dont_hash}]}}) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:12 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xc07e50cc7f0000}]) [ 2074.459782][T29863] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2074.489426][T29874] loop0: detected capacity change from 0 to 512 [ 2074.513492][T29863] loop5: detected capacity change from 0 to 4 [ 2074.533327][T29863] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:12 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000fffe800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2074.559997][T29874] EXT4-fs (loop0): bad geometry: block count 436207744 exceeds size of device (128 blocks) 17:22:12 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3b, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:12 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x20, 0x3}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) getpeername$packet(r4, &(0x7f00000001c0), &(0x7f0000000240)=0x14) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)) [ 2074.651749][T29874] loop0: detected capacity change from 0 to 512 [ 2074.673253][T29874] EXT4-fs (loop0): bad geometry: block count 436207744 exceeds size of device (128 blocks) [ 2074.674714][T29902] loop5: detected capacity change from 0 to 4 17:22:12 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xf0ff1f00000000}]) 17:22:12 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000002006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:12 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1400, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2074.726516][T29902] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:12 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x4}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x8001) [ 2074.805296][T29923] loop0: detected capacity change from 0 to 512 [ 2074.827278][T29902] loop5: detected capacity change from 0 to 4 [ 2074.836997][T29902] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2074.847026][T29923] EXT4-fs (loop0): bad geometry: block count 536871040 exceeds size of device (128 blocks) 17:22:12 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000002800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:12 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3c, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:12 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) r3 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r5 = socket(0x200000100000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) bind$packet(r5, &(0x7f0000000200)={0x11, 0x0, r6, 0x1, 0x1, 0x6, @random="65a9e1ff3a4a"}, 0x14) r7 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000480)=0x21) r9 = dup2(r7, r7) setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f0000000100)={r8, 0x1, 0x4, @local}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r3, 0x89f9, &(0x7f00000001c0)={'syztnl2\x00', &(0x7f0000000080)={'ip6_vti0\x00', r8, 0x29, 0x8, 0x4, 0x10001, 0x1, @remote, @local, 0x80, 0x1, 0x9, 0x2}}) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r10 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000000, 0x80010, r3, 0x0) syz_io_uring_setup(0x7020, &(0x7f0000000240)={0x0, 0x84ba, 0x8, 0x2, 0x316}, &(0x7f0000ff8000/0x7000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000300), &(0x7f0000000340)=0x0) syz_io_uring_submit(r10, r11, &(0x7f00000003c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x597, 0x3, &(0x7f0000000380)="b0e3a31e9f8b0ae1940d2c8c134b00a06255d9e9c9ce640e9908612cf1e1cd9b103d0073f9a75ed1cb7f7c2f2ec1b37a735893bb5f32578e78", 0x63e, 0x0, 0x1}, 0x7f) 17:22:12 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x100000000000000}]) [ 2074.938064][T29923] loop0: detected capacity change from 0 to 512 [ 2074.948463][T29923] EXT4-fs (loop0): bad geometry: block count 536871040 exceeds size of device (128 blocks) 17:22:12 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000102006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:12 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3d, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2074.992576][T29953] loop5: detected capacity change from 0 to 4 [ 2075.013375][T29960] device sit0 entered promiscuous mode [ 2075.029820][T29953] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:12 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1500, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2075.070106][T29955] device sit0 left promiscuous mode [ 2075.076533][T29960] device sit0 entered promiscuous mode [ 2075.084666][T29971] loop0: detected capacity change from 0 to 512 [ 2075.093228][T29953] loop5: detected capacity change from 0 to 4 [ 2075.099365][T29955] device sit0 left promiscuous mode [ 2075.105362][T29953] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:12 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000003800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:12 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) io_uring_enter(r4, 0x5448, 0x28ab, 0x0, &(0x7f0000000040)={[0xff]}, 0x8) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2075.125585][T29971] EXT4-fs (loop0): bad geometry: block count 537919616 exceeds size of device (128 blocks) [ 2075.169986][ C0] scsi_io_completion_action: 24 callbacks suppressed [ 2075.170011][ C0] sd 0:0:1:0: tag#1586 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2075.186536][ C0] sd 0:0:1:0: tag#1586 CDB: opcode=0xe5 (vendor) [ 2075.192905][ C0] sd 0:0:1:0: tag#1586 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2075.201972][ C0] sd 0:0:1:0: tag#1586 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2075.211017][ C0] sd 0:0:1:0: tag#1586 CDB[20]: ba 17:22:12 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3e, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2075.224671][T29971] loop0: detected capacity change from 0 to 512 [ 2075.233201][T29971] EXT4-fs (loop0): bad geometry: block count 537919616 exceeds size of device (128 blocks) 17:22:12 executing program 4: r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x3c, r0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x6}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004851}, 0x8880) r1 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r1, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r4 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = open_tree(r4, &(0x7f0000000040)='./file0\x00', 0x88c00) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f0000000380)={'syztnl2\x00', 0x0, 0x29, 0x6, 0x6, 0x6, 0x8, @mcast1, @loopback, 0x7808, 0x780, 0x81, 0x3f}}) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2075.278733][ C1] sd 0:0:1:0: tag#1595 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2075.288609][ C1] sd 0:0:1:0: tag#1595 CDB: opcode=0xe5 (vendor) [ 2075.294965][ C1] sd 0:0:1:0: tag#1595 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2075.304020][ C1] sd 0:0:1:0: tag#1595 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2075.313087][ C1] sd 0:0:1:0: tag#1595 CDB[20]: ba 17:22:12 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x200000000000000}]) [ 2075.340514][T30008] loop5: detected capacity change from 0 to 4 17:22:13 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000002206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2075.384473][T30008] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2075.414910][ C1] sd 0:0:1:0: tag#1579 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2075.424813][ C1] sd 0:0:1:0: tag#1579 CDB: opcode=0xe5 (vendor) [ 2075.431314][ C1] sd 0:0:1:0: tag#1579 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2075.440388][ C1] sd 0:0:1:0: tag#1579 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2075.448135][T30026] loop0: detected capacity change from 0 to 512 [ 2075.449438][ C1] sd 0:0:1:0: tag#1579 CDB[20]: ba 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x3dd6, &(0x7f0000000140)={0x0, 0x4007, 0x0, 0x1, 0x4}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x8, &(0x7f0000000080)=0xd45, 0x4) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r5 = mmap$IORING_OFF_SQES(&(0x7f0000002000/0x2000)=nil, 0x2000, 0xa, 0x11, r0, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000040)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x2) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2075.487202][T30008] loop5: detected capacity change from 0 to 4 [ 2075.509987][T30026] EXT4-fs (loop0): bad geometry: block count 570425472 exceeds size of device (128 blocks) 17:22:13 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x300, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:13 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x204000000000000}]) 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = mmap$IORING_OFF_SQES(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2000003, 0x4010, r0, 0x10000000) r4 = syz_io_uring_setup(0x187, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {}, 0x0, {0x0, r7}}, 0x0) syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, {0x0, r7}}, 0x1) [ 2075.541277][T30008] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:13 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000004800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:13 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1600, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2075.611440][T30026] loop0: detected capacity change from 0 to 512 [ 2075.618380][T30026] EXT4-fs (loop0): bad geometry: block count 570425472 exceeds size of device (128 blocks) 17:22:13 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000002506000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) setsockopt$packet_buf(r4, 0x107, 0x16, &(0x7f0000000040)="800f970ba9def2c4ad833d68c9b44dc4d4ab9eb0ca0ba4e7e9f9d5182f8fd54b5994c34adc7d1e480d3dadca85612793", 0x30) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x40010, r0, 0x8000000) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2075.671660][ C1] sd 0:0:1:0: tag#1591 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2075.674572][T30072] loop5: detected capacity change from 0 to 4 [ 2075.681875][ C1] sd 0:0:1:0: tag#1591 CDB: opcode=0xe5 (vendor) [ 2075.681903][ C1] sd 0:0:1:0: tag#1591 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2075.681919][ C1] sd 0:0:1:0: tag#1591 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2075.681934][ C1] sd 0:0:1:0: tag#1591 CDB[20]: ba 17:22:13 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x500, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2075.769395][T30072] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2075.796706][T30086] loop0: detected capacity change from 0 to 512 [ 2075.799256][ C1] sd 0:0:1:0: tag#1561 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2075.812805][ C1] sd 0:0:1:0: tag#1561 CDB: opcode=0xe5 (vendor) 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x10}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2075.819134][ C1] sd 0:0:1:0: tag#1561 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2075.819820][T30086] EXT4-fs (loop0): bad geometry: block count 620757120 exceeds size of device (128 blocks) [ 2075.828160][ C1] sd 0:0:1:0: tag#1561 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2075.847482][ C1] sd 0:0:1:0: tag#1561 CDB[20]: ba 17:22:13 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x300000000000000}]) 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/unix\x00') io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000340)=[{&(0x7f0000000240)=""/241, 0xf1}, {&(0x7f0000000080)=""/101, 0x65}, {&(0x7f00000001c0)}], 0x3) [ 2075.908769][T30072] loop5: detected capacity change from 0 to 4 [ 2075.916961][T30072] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2075.933408][T30086] loop0: detected capacity change from 0 to 512 [ 2075.948314][T30086] EXT4-fs (loop0): bad geometry: block count 620757120 exceeds size of device (128 blocks) 17:22:13 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1700, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$F2FS_IOC_GET_FEATURES(r3, 0x8004f50c, &(0x7f0000000040)) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2075.969210][ C1] sd 0:0:1:0: tag#1563 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2075.979057][ C1] sd 0:0:1:0: tag#1563 CDB: opcode=0xe5 (vendor) [ 2075.985416][ C1] sd 0:0:1:0: tag#1563 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2075.994479][ C1] sd 0:0:1:0: tag#1563 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2076.003520][ C1] sd 0:0:1:0: tag#1563 CDB[20]: ba 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000002780)=@IORING_OP_RECVMSG={0xa, 0x1, 0x0, r3, 0x0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000016c0)=[{&(0x7f0000000240)=""/213, 0xd5}, {&(0x7f0000000040)=""/125, 0x7d}, {&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000001480)=""/112, 0x70}, {&(0x7f00000000c0)=""/46, 0x2e}, {&(0x7f0000001500)=""/79, 0x4f}, {&(0x7f0000001580)=""/68, 0x44}, {&(0x7f0000001600)=""/175, 0xaf}], 0x9, &(0x7f0000001780)=""/4096, 0x1000}, 0x0, 0x10060, 0x1, {0x1}}, 0x4b71) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:13 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000022d06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:13 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000005800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:13 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x600, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2076.118417][T30141] loop5: detected capacity change from 0 to 4 [ 2076.126352][T30142] loop0: detected capacity change from 0 to 512 [ 2076.140071][ C0] sd 0:0:1:0: tag#1547 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2076.149940][ C0] sd 0:0:1:0: tag#1547 CDB: opcode=0xe5 (vendor) [ 2076.156266][ C0] sd 0:0:1:0: tag#1547 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_READ_FIXED={0x4, 0x5, 0x0, @fd_index=0x9, 0x6, 0x8, 0x1, 0x8, 0x1, {0x1}}, 0x100) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2076.165318][ C0] sd 0:0:1:0: tag#1547 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2076.169835][T30141] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2076.174357][ C0] sd 0:0:1:0: tag#1547 CDB[20]: ba 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000240)={0x0, 0x60ed, 0x10, 0x0, 0x2a8}, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_setup(0xc81, &(0x7f0000000140)={0x0, 0x41ae, 0x20, 0x2, 0x88, 0x0, r0}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000000040), &(0x7f00000000c0)) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r3, 0xa, 0x0, 0x0) ioctl$TIOCSERGETLSR(r3, 0x5459, &(0x7f0000000080)) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r3, 0x3) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:13 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x400000000000000}]) [ 2076.279910][T30142] EXT4-fs (loop0): bad geometry: block count 755105920 exceeds size of device (128 blocks) [ 2076.283297][T30141] loop5: detected capacity change from 0 to 4 [ 2076.313876][ C1] sd 0:0:1:0: tag#1562 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2076.323723][ C1] sd 0:0:1:0: tag#1562 CDB: opcode=0xe5 (vendor) 17:22:13 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) io_uring_enter(r0, 0x58ff, 0x5c92, 0x0, &(0x7f0000000380)={[0x3ff]}, 0x8) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x101000, 0x0) r4 = signalfd4(r0, &(0x7f00000001c0)={[0x4]}, 0x8, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r3, 0x891b, &(0x7f00000000c0)={'team_slave_1\x00', {0x2, 0x0, @broadcast}}) io_uring_enter(r0, 0x3a3, 0xafbf, 0x2, &(0x7f0000000040)={[0x149]}, 0x8) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = syz_open_dev$vcsu(&(0x7f0000000240), 0x1, 0x200800) preadv(r4, &(0x7f0000000600)=[{&(0x7f0000000480)=""/159, 0x9f}, {&(0x7f0000000540)=""/157, 0x9d}, {&(0x7f00000003c0)=""/40, 0x28}], 0x3, 0x5, 0x20) read(r5, &(0x7f0000000280)=""/237, 0xed) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2076.330069][ C1] sd 0:0:1:0: tag#1562 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2076.339092][ C1] sd 0:0:1:0: tag#1562 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2076.348161][ C1] sd 0:0:1:0: tag#1562 CDB[20]: ba 17:22:14 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1800, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:14 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x700, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:14 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000006800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2076.402833][T30142] loop0: detected capacity change from 0 to 512 [ 2076.409295][T30141] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2076.433929][T30142] EXT4-fs (loop0): bad geometry: block count 755105920 exceeds size of device (128 blocks) 17:22:14 executing program 4: recvmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000240)=@abs, 0x6e, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/206, 0xce}, {&(0x7f0000000480)=""/189, 0xbd}, {&(0x7f0000000540)=""/189, 0xbd}], 0x3, &(0x7f0000000600)=[@cred={{0x1c}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}, 0x2) r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0xf}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) io_pgetevents(0x0, 0x8, 0x2, &(0x7f0000000040)=[{}, {}], &(0x7f0000000080)={0x77359400}, &(0x7f00000001c0)={&(0x7f00000000c0)={[0xffffffffffffffff]}, 0x8}) 17:22:14 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000002e06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:14 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x500000000000000}]) [ 2076.530299][T30190] loop0: detected capacity change from 0 to 512 [ 2076.558774][T30190] EXT4-fs (loop0): bad geometry: block count 771752064 exceeds size of device (128 blocks) [ 2076.569100][ C0] sd 0:0:1:0: tag#1556 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2076.578937][ C0] sd 0:0:1:0: tag#1556 CDB: opcode=0xe5 (vendor) [ 2076.585310][ C0] sd 0:0:1:0: tag#1556 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2076.585542][T30202] loop5: detected capacity change from 0 to 4 [ 2076.594358][ C0] sd 0:0:1:0: tag#1556 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2076.594377][ C0] sd 0:0:1:0: tag#1556 CDB[20]: ba 17:22:14 executing program 4: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) r1 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r1, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2076.639221][ C0] sd 0:0:1:0: tag#1557 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2076.649114][ C0] sd 0:0:1:0: tag#1557 CDB: opcode=0xe5 (vendor) [ 2076.655553][ C0] sd 0:0:1:0: tag#1557 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2076.664602][ C0] sd 0:0:1:0: tag#1557 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2076.673654][ C0] sd 0:0:1:0: tag#1557 CDB[20]: ba [ 2076.678989][T30202] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:14 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x900, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:14 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1900, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:14 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x600000000000000}]) 17:22:14 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000080)={0x0, 0xa296, 0x2, 0x3}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) r4 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) sendfile(r3, r4, 0x0, 0x65) 17:22:14 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000003206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2076.742107][T30202] loop5: detected capacity change from 0 to 4 [ 2076.747479][T30190] loop0: detected capacity change from 0 to 512 [ 2076.758848][T30202] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2076.766126][T30190] EXT4-fs (loop0): bad geometry: block count 771752064 exceeds size of device (128 blocks) 17:22:14 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000007800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:14 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x80, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2076.870354][T30248] loop0: detected capacity change from 0 to 512 [ 2076.890536][T30252] loop5: detected capacity change from 0 to 4 [ 2076.904825][T30252] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:14 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xa00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:14 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x129, 0x0, 0x3, 0xfffffffc}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = open(&(0x7f0000000980)='./bus\x00', 0x14d842, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r3, 0x4030582b, &(0x7f0000000040)={0xc, 0xffffffffffffffff, 0x0, 0x6}) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r4 = socket$inet6(0xa, 0x401000000001, 0x0) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x800100000001) io_uring_enter(r5, 0x46a0, 0xaab, 0x3, &(0x7f00000000c0)={[0x4]}, 0x8) [ 2076.949857][T30248] EXT4-fs (loop0): bad geometry: block count 838860928 exceeds size of device (128 blocks) 17:22:14 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1a00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:14 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x604000000000000}]) [ 2077.028263][T30252] loop5: detected capacity change from 0 to 4 [ 2077.035309][T30248] loop0: detected capacity change from 0 to 512 [ 2077.043114][T30252] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2077.061875][T30248] EXT4-fs (loop0): bad geometry: block count 838860928 exceeds size of device (128 blocks) 17:22:14 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000003506000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:14 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) syz_io_uring_submit(r1, r4, &(0x7f00000001c0)=@IORING_OP_WRITE={0x17, 0x2, 0x4007, @fd=r5, 0x80000000, &(0x7f0000000040)="174178e66383fbe071d0e72c5257e30750fad5ab4f84e79add6af2cc32f730281d71fc6841a3d0df463ab02d5d7fa62b624cfca2b5ce7964dbd2f5988fb109ced34473448d6019f892328fd0f87224cf35f56191c32496b9f779f6a4d00087e39b2028965faab8ade0b7feea72bb6116c997475e92acbc5bfbf09ae28eb5ee13165ee6c7f39492d0a574151eb62bc3b3b204fa7cc36b30e75eaefef8fac36e0d40", 0xa1, 0x10}, 0x401) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:14 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000008800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:14 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) r4 = memfd_create(&(0x7f00000000c0)='\x00', 0x2) ppoll(&(0x7f00000001c0)=[{0xffffffffffffffff, 0x3008}, {r3, 0x2084}, {r4, 0x2030}], 0x3, &(0x7f0000000240)={0x77359400}, &(0x7f0000000280)={[0x1d0]}, 0x8) ioctl(r4, 0x7, &(0x7f00000002c0)="d97453c17640247bb47daca06e1d64089ee117eb54603743906038fa973335fec5e38d12e8f2b4960d2f6070de8c7a5347ac1abaf7e8c26875f85a9b12d3987b3cd5737a7779e2a3f3f8990703b89f676c2f0d235a3f69") close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:14 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xb00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2077.203408][T30296] loop5: detected capacity change from 0 to 4 [ 2077.209136][T30297] loop0: detected capacity change from 0 to 512 [ 2077.232421][T30296] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2077.262997][T30297] EXT4-fs (loop0): bad geometry: block count 889192576 exceeds size of device (128 blocks) [ 2077.291120][T30296] loop5: detected capacity change from 0 to 4 [ 2077.299967][T30296] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:14 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x700000000000000}]) 17:22:14 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000e800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2077.308251][T30297] loop0: detected capacity change from 0 to 512 [ 2077.323449][T30297] EXT4-fs (loop0): bad geometry: block count 889192576 exceeds size of device (128 blocks) 17:22:15 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000003f06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:15 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xb35, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:15 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1b00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2077.440021][T30338] loop5: detected capacity change from 0 to 4 [ 2077.447280][T30343] loop0: detected capacity change from 0 to 512 [ 2077.461323][T30338] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2077.471505][T30343] EXT4-fs (loop0): bad geometry: block count 1056964736 exceeds size of device (128 blocks) [ 2077.501356][T30338] loop5: detected capacity change from 0 to 4 [ 2077.513906][T30338] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2077.536604][T30343] loop0: detected capacity change from 0 to 512 17:22:15 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000f800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:15 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x800000000000000}]) [ 2077.547058][T30343] EXT4-fs (loop0): bad geometry: block count 1056964736 exceeds size of device (128 blocks) 17:22:15 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xc00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:15 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2077.615140][T30370] loop5: detected capacity change from 0 to 4 [ 2077.641280][T30370] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2077.676422][T30377] loop0: detected capacity change from 0 to 512 [ 2077.697519][T30377] EXT4-fs (loop0): bad geometry: block count 1073741952 exceeds size of device (128 blocks) [ 2077.717190][T30370] loop5: detected capacity change from 0 to 4 17:22:15 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1c00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2077.727059][T30370] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2077.791259][T30377] loop0: detected capacity change from 0 to 512 [ 2077.810185][T30377] EXT4-fs (loop0): bad geometry: block count 1073741952 exceeds size of device (128 blocks) 17:22:15 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x900000000000000}]) 17:22:15 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000010800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:15 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xd00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:15 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:15 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffffff, &(0x7f0000001500)='./file0\x00', 0x401, 0x80) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r0) syz_io_uring_setup(0x529a, &(0x7f0000001540)={0x0, 0x2f43, 0x4, 0x0, 0x65, 0x0, r3}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000015c0), &(0x7f0000001600)=0x0) r5 = syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r8 = syz_io_uring_setup(0x187, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) r11 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {}, 0x0, {0x0, r11}}, 0x0) syz_io_uring_submit(r6, r4, &(0x7f0000001680)=@IORING_OP_LINK_TIMEOUT={0xf, 0x4, 0x0, 0x0, 0x0, &(0x7f0000001640)={0x0, 0x3938700}, 0x1, 0x0, 0x1, {0x0, r11}}, 0x2) r12 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r13 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000002, 0x110, r5, 0x10000000) syz_io_uring_submit(r1, r13, &(0x7f00000016c0)=@IORING_OP_MADVISE={0x19, 0x1, 0x0, 0x0, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xe, 0x1}, 0x6) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r14 = accept$packet(r12, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000080)=0x14) recvmmsg(r14, &(0x7f0000001400)=[{{&(0x7f0000000240)=@in6={0xa, 0x0, 0x0, @local}, 0x80, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/10, 0xa}, {&(0x7f00000002c0)=""/142, 0x8e}], 0x2, &(0x7f0000000480)=""/170, 0xaa}, 0x4}, {{&(0x7f0000000380)=@ieee802154={0x24, @short}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000540)=""/10, 0xa}, {&(0x7f0000000580)=""/182, 0xb6}, {&(0x7f0000000640)=""/22, 0x16}], 0x3, &(0x7f00000006c0)=""/244, 0xf4}, 0x5}, {{&(0x7f00000007c0)=@generic, 0x80, &(0x7f0000000d80)=[{&(0x7f0000000840)=""/121, 0x79}, {&(0x7f00000008c0)=""/250, 0xfa}, {&(0x7f00000009c0)=""/223, 0xdf}, {&(0x7f0000000ac0)=""/208, 0xd0}, {&(0x7f0000000bc0)=""/222, 0xde}, {&(0x7f0000000cc0)=""/132, 0x84}], 0x6, &(0x7f0000000e00)=""/34, 0x22}, 0x2}, {{0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000e40)=""/169, 0xa9}, {&(0x7f0000000f00)=""/153, 0x99}, {&(0x7f0000000fc0)=""/183, 0xb7}, {&(0x7f0000001080)=""/20, 0x14}, {&(0x7f00000010c0)=""/171, 0xab}, {&(0x7f0000001180)=""/201, 0xc9}, {&(0x7f0000001280)=""/166, 0xa6}], 0x7, &(0x7f00000013c0)=""/44, 0x2c}, 0x80}], 0x4, 0x102, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x300000f, 0x2010, r14, 0x85d38000) 17:22:15 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1d00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2078.145333][T30417] loop5: detected capacity change from 0 to 4 [ 2078.157087][T30420] loop0: detected capacity change from 0 to 512 [ 2078.178484][T30417] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2078.185320][T30420] EXT4-fs (loop0): bad geometry: block count 1124073600 exceeds size of device (128 blocks) 17:22:15 executing program 4: sendmsg$NLBL_UNLABEL_C_LIST(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000240)={0xa4, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010100}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'wg0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast2}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'veth0\x00'}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'xfrm0\x00'}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @ipv4={'\x00', '\xff\xff', @empty}}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @empty}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x2b}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x800}, 0x0) r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000001c0)={@local, @initdev}, &(0x7f0000000300)=0xc) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) io_uring_enter(r0, 0x2cfd, 0x3aaf, 0x0, &(0x7f0000000340)={[0x7]}, 0x8) 17:22:15 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xa00000000000000}]) [ 2078.230337][T30417] loop5: detected capacity change from 0 to 4 [ 2078.238070][T30420] loop0: detected capacity change from 0 to 512 [ 2078.259633][T30417] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2078.269650][T30420] EXT4-fs (loop0): bad geometry: block count 1124073600 exceeds size of device (128 blocks) 17:22:15 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xe00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:15 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000001b800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:15 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000400)=0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r2, r1, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2078.414168][T30463] loop5: detected capacity change from 0 to 4 [ 2078.416859][T30464] loop0: detected capacity change from 0 to 512 [ 2078.447295][T30463] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:16 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xf00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:16 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xb00000000000000}]) [ 2078.461059][T30464] EXT4-fs (loop0): bad geometry: block count 1140850816 exceeds size of device (128 blocks) 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x8017e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0xe0}, &(0x7f0000003000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = signalfd(0xffffffffffffffff, &(0x7f0000000080)={[0x3]}, 0x8) io_uring_enter(r3, 0x500, 0x1a0a, 0x1, &(0x7f00000000c0)={[0x6]}, 0x8) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:16 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1e00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) syz_io_uring_setup(0x4a42, &(0x7f0000000040)={0x0, 0x3fec, 0x8, 0x0, 0xe9, 0x0, r4}, &(0x7f0000003000/0x1000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f00000000c0), &(0x7f00000001c0)) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0x6]}, 0x8) [ 2078.520615][T30463] loop5: detected capacity change from 0 to 4 [ 2078.527169][T30464] loop0: detected capacity change from 0 to 512 [ 2078.536965][T30463] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2078.551189][T30464] EXT4-fs (loop0): bad geometry: block count 1140850816 exceeds size of device (128 blocks) 17:22:16 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f0000000000000000fe800000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:16 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000014606000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:16 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xc00000000000000}]) 17:22:16 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1100, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) io_uring_enter(r4, 0x25c8, 0x3f4a, 0x3, &(0x7f0000000040)={[0x7]}, 0x8) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2078.700749][T30512] loop5: detected capacity change from 0 to 4 [ 2078.707787][T30514] loop0: detected capacity change from 0 to 512 [ 2078.727528][T30512] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:16 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800200000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2078.764407][T30514] EXT4-fs (loop0): bad geometry: block count 1174470784 exceeds size of device (128 blocks) 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xfffffffd}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r4, 0x4, &(0x7f0000000080)=r5, 0x1) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2078.843513][T30544] loop5: detected capacity change from 0 to 4 [ 2078.878445][T30514] loop0: detected capacity change from 0 to 512 17:22:16 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1200, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:16 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xd00000000000000}]) [ 2078.888959][T30544] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2078.898722][T30514] EXT4-fs (loop0): bad geometry: block count 1174470784 exceeds size of device (128 blocks) 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x2000000000002, 0x0, 0x0, 0x3}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000000)=@IORING_OP_NOP={0x0, 0x1}, 0x8001) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2078.960736][T30544] loop5: detected capacity change from 0 to 4 [ 2078.972638][T30544] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:16 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1f00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:16 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000040)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x3, 0x0, @fd_index=0x3, 0x3, 0x0, 0x40, 0x2}, 0x5) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2079.039365][T30583] loop0: detected capacity change from 0 to 512 17:22:16 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800300000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:16 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xe00000000000000}]) 17:22:16 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1300, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2079.086954][T30583] EXT4-fs (loop0): bad geometry: block count 1207959680 exceeds size of device (128 blocks) [ 2079.131771][T30597] loop5: detected capacity change from 0 to 4 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x40000000}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000540)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x7b8f, &(0x7f0000000280)={0x0, 0xb8f4, 0x4, 0x3, 0x399, 0x0, r0}, &(0x7f0000003000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000000300)=0x0, &(0x7f0000000340)) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r2, &(0x7f0000000380)=@IORING_OP_READ_FIXED={0x4, 0x2, 0x4007, @fd_index=0x8, 0x11, 0x8, 0x7, 0x17, 0x0, {0x1, r4}}, 0x7) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r5 = syz_io_uring_setup(0x387d, &(0x7f0000000040)={0x0, 0xd885, 0x1, 0x3, 0x60}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f00000000c0)=0x0, &(0x7f00000001c0)) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r6, r2, &(0x7f0000000240)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x2000, @fd_index=0x2, 0x7, 0xff8, 0x40, 0x1, 0x1, {0x1, r7}}, 0x5) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x5d5f, &(0x7f0000000480)={0x0, 0x1620, 0x20, 0x2, 0x36b, 0x0, r5}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f00000003c0), &(0x7f0000000500)) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2079.173680][T30597] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2079.176785][T30583] loop0: detected capacity change from 0 to 512 [ 2079.201050][T30583] EXT4-fs (loop0): bad geometry: block count 1207959680 exceeds size of device (128 blocks) 17:22:16 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xf00000000000000}]) 17:22:16 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1400, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2079.250342][T30597] loop5: detected capacity change from 0 to 4 [ 2079.263679][T30597] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:16 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004c06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:16 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'virt_wifi0\x00'}) getsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8) close(0xffffffffffffffff) r5 = accept4$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000240)=0x1c, 0x0) getsockopt$IP_SET_OP_VERSION(r5, 0x1, 0x53, &(0x7f0000000280), &(0x7f00000002c0)=0x8) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:16 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:16 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800400000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2079.339377][T30634] loop0: detected capacity change from 0 to 512 [ 2079.347709][T30634] EXT4-fs (loop0): bad geometry: block count 1275068544 exceeds size of device (128 blocks) 17:22:17 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000024e06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:17 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x200000006, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r4 = socket(0x200000100000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) bind$packet(r4, &(0x7f0000000200)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) sendmsg$ETHTOOL_MSG_COALESCE_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00022dbd70001501df25130000000c00018008000100", @ANYRES32=0x0, @ANYBLOB="0c00018008000100", @ANYRES32=r5, @ANYBLOB="b7672b33f4e51000033f2e2316dc3f"], 0x2c}, 0x1, 0x0, 0x0, 0x8084}, 0x24008885) close(0xffffffffffffffff) r6 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340)={0x0, 0x24e0, 0x0, 0x0, 0x8000}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) r9 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r9, &(0x7f0000000480)="5c4d062eb378e4a700f8c972d42e94ace0614097a3cbb45dd5da83650c10748edfd156047c911eec9ec4beaee4f30ca973f59c1772a878f32478c3ff2f985aefe33d3236d04e0fb30521f219289a9ab026fc5ed9606c8a5898879b315e353e8679165439dad9cc5fdb56ff9e371a1f55107730b04e3d1a0f04836b6058f3c63440c6d9853d9560c771fab1bf43f175a1f4947a5cdff73631966629ec89228719a7f9e2e1d51133ab71b596dd07d72991d6c06284bac1e8f3b054320731701cb07ef2ce4a7bcf7cd1c420b7b9af0697800d78281803c9b527306c", 0xda) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(0x0, r2, &(0x7f00000003c0)=@IORING_OP_MADVISE={0x19, 0x2, 0x0, 0x0, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x7b}, 0x7) syz_io_uring_submit(r1, r8, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x3, 0x0, @fd=r6, 0x0, 0x0, 0x0, {0x4000}}, 0x81) mknod(&(0x7f0000000080)='./file0\x00', 0x7a86, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2079.412545][T30650] loop5: detected capacity change from 0 to 4 [ 2079.418282][T30634] loop0: detected capacity change from 0 to 512 [ 2079.431880][T30634] EXT4-fs (loop0): bad geometry: block count 1275068544 exceeds size of device (128 blocks) [ 2079.448746][T30650] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:17 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1500, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:17 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1000000000000000}]) 17:22:17 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) pidfd_getfd(0xffffffffffffffff, r0, 0x0) io_uring_enter(r0, 0x22e5, 0x0, 0x3, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/cgroup', 0x24180, 0x2) setsockopt$packet_tx_ring(r3, 0x107, 0xd, &(0x7f0000000080)=@req3={0x3, 0x3ff, 0x8, 0x8, 0x800, 0x7f, 0x70a8}, 0x1c) 17:22:17 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800500000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2079.537161][T30650] loop5: detected capacity change from 0 to 4 [ 2079.543646][T30667] loop0: detected capacity change from 0 to 512 [ 2079.564966][T30667] EXT4-fs (loop0): bad geometry: block count 1308754048 exceeds size of device (128 blocks) [ 2079.575638][T30650] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:17 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000025206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:17 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x8}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) splice(r0, &(0x7f0000000040)=0x7, r0, &(0x7f0000000080)=0x9, 0x2, 0xe) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r6 = socket$inet6(0xa, 0x401000000001, 0x0) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r6, r7, 0x0, 0x800100000001) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/meminfo\x00', 0x0, 0x0) r8 = socket$inet6(0xa, 0x401000000001, 0x0) close(r8) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r2, &(0x7f00000001c0)=@IORING_OP_STATX={0x15, 0x2, 0x0, 0xffffffffffffff9c, &(0x7f0000000240), &(0x7f00000000c0)='./file0\x00', 0x100, 0x0, 0x0, {0x0, r9}}, 0x5) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2079.662120][T30698] loop0: detected capacity change from 0 to 512 [ 2079.675629][T30701] loop5: detected capacity change from 0 to 4 [ 2079.698104][T30701] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:17 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2100, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2079.723297][T30698] EXT4-fs (loop0): bad geometry: block count 1375862912 exceeds size of device (128 blocks) [ 2079.755836][T30701] loop5: detected capacity change from 0 to 4 [ 2079.765003][T30698] loop0: detected capacity change from 0 to 512 17:22:17 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1100000000000000}]) 17:22:17 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1600, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2079.771877][T30701] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2079.783974][T30698] EXT4-fs (loop0): bad geometry: block count 1375862912 exceeds size of device (128 blocks) 17:22:17 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000003c0), 0x143000, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1000004, 0x10010, r3, 0x10000000) close(0xffffffffffffffff) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r6 = syz_io_uring_setup(0x187, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {}, 0x0, {0x0, r9}}, 0x4000) r10 = socket$inet6(0xa, 0x401000000001, 0x0) close(r10) r11 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) sendfile(r10, r11, 0x0, 0x800100000001) io_uring_register$IORING_REGISTER_BUFFERS(r11, 0x0, &(0x7f0000000900)=[{&(0x7f0000000680)=""/8, 0x8}, {&(0x7f00000006c0)=""/217, 0xd9}, {&(0x7f00000007c0)=""/61, 0x3d}, {&(0x7f0000000800)=""/213, 0xd5}], 0x4) syz_io_uring_submit(r1, r5, &(0x7f0000000340)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @rand_addr=0x64010101}, 0x0, 0x1, 0x4, 0x3}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000240)="673ec1d929f80aa196e560e9c5801e0949edc032af911a6c568bff5d4b26b300191d1d0e6603137908c271dcf21730d6e9f5b34679331443e4b8ebaedd08f1c00d97b99ff43955001ba83a80978b94a655f51d4976f1d3f9719c88bcbbbc9ed9da5f9c8532a050e711935d6c5fa27224526469606fd822d4c4d207714729d75a1074361bbe61e6be232887251397f54e8cd553020a388a7b5ef47bfaf15bd2415e433476290b74c4bbe50db7d42e60363252db53d54d5e7a71e237d797eb04f1aaed5564798212ee5e70d699c9d1aebe", 0xd0}, {&(0x7f0000000480)="d8b0e42106fd50e2990317aa6b7ddd17c61c3cdda9a5cb1a944792348f1edce81aeca9399f2a9209834776f6db800842e938697172e22db7803823e2a0fa9fbd87969163edce1928c7ddea69eaf1690105c5b20005cd907bed809a4839722e538c40fde0db5b8b456d54cf957b2b3d4a4897e26673a56d758702d745941fe0b712efe605b945442c31fb65cc3a354f12514f57886099ce6d2da3458e20a4c206dc246e119b131c7632b12cbf84f10a16ac935c30e5aa58ab27cd55095d456e5f7e8764941d0c1e5095ce16f80703139e465a9ffccaca9ce0a5329ed0315685bd6cf7", 0xe2}], 0x2, &(0x7f0000000580)=ANY=[@ANYBLOB="80000000000000000100000008000000f04ce1868489cd5e04c15992b2a6451ea00ed276da224e44644c5fdc13c1c65137906681dbc8d9d2e1c0553c983e4e969be2cca80c6dd3f9625c3887d2edb44a673687cc3a5e6d65165dcf355d1732d3d4146cd40681fcdf517510c577920197545d3c01f0001800000000000000c94cb8c4020000008f250000000000004800000000000000030100000100c88291504582977597281c2bf27e41fca7add2e0bae00bf9089c9ea62ef2b11a6e1527f682c2e369c3deeb982c0000000000000000000000000000002c9583be00000000"], 0xe0}, 0x0, 0x42005, 0x5f41614a6c566fd5, {0x0, r9}}, 0x1) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:17 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800600000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:17 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000025306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:17 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:17 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1700, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2079.916360][T30743] loop5: detected capacity change from 0 to 4 [ 2079.931585][T30750] loop0: detected capacity change from 0 to 512 [ 2079.945965][T30750] EXT4-fs (loop0): bad geometry: block count 1392640128 exceeds size of device (128 blocks) 17:22:17 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1200000000000000}]) [ 2079.981424][T30743] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2080.004542][T30750] loop0: detected capacity change from 0 to 512 [ 2080.020424][T30750] EXT4-fs (loop0): bad geometry: block count 1392640128 exceeds size of device (128 blocks) 17:22:17 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x2) io_uring_enter(r4, 0x400020a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/bus/usb', 0x20000, 0x122) sendfile(r5, r6, &(0x7f00000000c0)=0x10000, 0x1f) [ 2080.034146][T30743] loop5: detected capacity change from 0 to 4 [ 2080.049638][T30743] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:17 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000006006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:17 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2200, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:17 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1800, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:17 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800700000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2080.107630][T30784] loop0: detected capacity change from 0 to 512 [ 2080.128231][T30784] EXT4-fs (loop0): bad geometry: block count 1610612864 exceeds size of device (128 blocks) 17:22:17 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000008, 0x20010, r0, 0x10000000) syz_io_uring_submit(r1, r3, &(0x7f0000000040)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x1, 0x0, @fd=r0, 0x4, 0x0, 0x1, 0xf, 0x1}, 0x7ff) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:17 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000006806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2080.207139][T30800] loop5: detected capacity change from 0 to 4 [ 2080.232241][T30800] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:17 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000001700)=[{&(0x7f0000000040)=""/9, 0x9}, {&(0x7f0000000240)=""/147, 0x93}, {&(0x7f0000000080)=""/51, 0x33}, {&(0x7f0000000300)=""/150, 0x96}, {&(0x7f00000000c0)=""/54, 0x36}, {&(0x7f0000000480)=""/97, 0x61}, {&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000001500)=""/233, 0xe9}, {&(0x7f0000001600)=""/225, 0xe1}], 0x9) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2080.263416][T30814] loop0: detected capacity change from 0 to 512 [ 2080.275064][T30800] loop5: detected capacity change from 0 to 4 [ 2080.284739][ C1] scsi_io_completion_action: 24 callbacks suppressed [ 2080.284770][ C1] sd 0:0:1:0: tag#1571 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2080.301273][ C1] sd 0:0:1:0: tag#1571 CDB: opcode=0xe5 (vendor) 17:22:17 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1300000000000000}]) [ 2080.307602][ C1] sd 0:0:1:0: tag#1571 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2080.316634][ C1] sd 0:0:1:0: tag#1571 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2080.322271][T30800] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2080.325694][ C1] sd 0:0:1:0: tag#1571 CDB[20]: ba [ 2080.345769][T30814] EXT4-fs (loop0): bad geometry: block count 1744830592 exceeds size of device (128 blocks) 17:22:18 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_MADVISE={0x19, 0x1, 0x0, 0x0, 0x0, &(0x7f0000003000/0x4000)=nil, 0x4000, 0x0, 0x1, {0x0, r3}}, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) io_uring_enter(r4, 0x7df6, 0x11e4, 0x1, &(0x7f0000000080)={[0x100000000]}, 0x8) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:18 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1900, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2080.368326][ C1] sd 0:0:1:0: tag#1591 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2080.378186][ C1] sd 0:0:1:0: tag#1591 CDB: opcode=0xe5 (vendor) [ 2080.385146][ C1] sd 0:0:1:0: tag#1591 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2080.394180][ C1] sd 0:0:1:0: tag#1591 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2080.403225][ C1] sd 0:0:1:0: tag#1591 CDB[20]: ba 17:22:18 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800800000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:18 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000006c06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:18 executing program 4: r0 = syz_io_uring_setup(0x17e5, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x40}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r4 = syz_io_uring_setup(0xb98, &(0x7f0000000040)={0x0, 0xe816, 0x0, 0x2, 0x1da, 0x0, r3}, &(0x7f0000001000/0x3000)=nil, &(0x7f0000001000/0x1000)=nil, &(0x7f00000000c0), &(0x7f00000001c0)=0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000580)=@IORING_OP_WRITEV={0x2, 0x1, 0x2000, @fd=r0, 0x80000001, &(0x7f0000000540)=[{&(0x7f0000000240)="bde39df0ade479b77af5a7d15dcb02c1c4d28e672e173f9b666cc27d545f8d296e3c4a37168c373c1bd117b9c73d43e9d653aab035c53aad30991f8f8bcd0dc1ae22248e25ef4d2e3cafa3b8e90a3472373bb94077b0c265f7089a9c36263582cc3171a18e9c298fbecd0bf37ff3de87de4f2fcefb9bec18b57c42f8207168bed9ac837b0895d47c12633fd1a69b1b510b1d112e2637deb1fb90979808b6c4c58cc7a494ef1b0eb06dc40ef76d50c0a2444b69016fb7bf46779eea00732318de1b00a6a029bc58ebd6ec9eee451a1e4d15daa53e959588a7fa56a894581358ea82d68ef7c6973262169f74", 0xeb}, {&(0x7f0000000340)="baafce1f55c08b1eeb63b6699d7ad5d2e3f53b63942c3311ebff0cc82bbe8478d1bc18d4bb0ac80e2802a0ebfcbf2900dff7d845fc374fe945f36a31e9f20d60c9caa0ba0e46dc9d78ec59d4f7685637953364f9144992faa7f9103f87101ba725abb1224b90c790764b539957871f5c2b627bc4794c2ae7e439118eba53d3455897ad26e30be07721ab7092c81b5dfac20892203fffc98f7f466d16d2da2e748fbcaa6da1d6fec4865a35feeb", 0xad}, {&(0x7f0000000480)="e6cab261068675cb09712eaff983d8a7e12a4325644d2de1deb4eb172a135d5c5d14b769a3f1c2f81ae5c2db8dce423800a594a9fbfeef8c51e501e7b40b2fdf7166167378503fd54ba4f79da1ad241356ee5827e1e4ad30d467d8eb7b6640131afe224f878689fbd42c0339e22c757d21b2cc9be8a046cc32585bd1cf105efba46b8f30a605d0b2a776b8bf549fcac2fb85335d79bd464b8d70fbcb7f8a41b638cdce9334538a705830", 0xaa}], 0x3, 0x1, 0x1, {0x3}}, 0xfffffc1c) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) 17:22:18 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2080.546822][T30857] loop0: detected capacity change from 0 to 512 [ 2080.550561][ C1] sd 0:0:1:0: tag#1558 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2080.556583][T30859] loop5: detected capacity change from 0 to 4 [ 2080.563007][ C1] sd 0:0:1:0: tag#1558 CDB: opcode=0xe5 (vendor) [ 2080.575371][ C1] sd 0:0:1:0: tag#1558 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2080.584668][ C1] sd 0:0:1:0: tag#1558 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 17:22:18 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) syz_io_uring_submit(r1, r2, &(0x7f00000000c0)=@IORING_OP_SEND={0x1a, 0x3, 0x0, r3, 0x0, &(0x7f0000000040)="2ebb7803648d3399ee44151bef0f316471d9c430535bf80dd4f303a8625dc59d2028786229a6129c2bab66f994034310b5874c7128e498dad93d1e52c741cb0d66d3e5050128f2703717524f9eb1e67dbd917e857292e25faa5d6826617d1ab943001a5e78e16c3379feb8329aec3c328cd3e9", 0x73, 0x20000400}, 0x101) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x401000000001, 0x0) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x800100000001) r7 = creat(&(0x7f00000001c0)='./file0\x00', 0xaa) dup2(r6, r7) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2080.593733][ C1] sd 0:0:1:0: tag#1558 CDB[20]: ba [ 2080.595034][T30857] EXT4-fs (loop0): bad geometry: block count 1811939456 exceeds size of device (128 blocks) 17:22:18 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000007406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:18 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1a00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2080.638160][ C0] sd 0:0:1:0: tag#1541 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2080.648017][ C0] sd 0:0:1:0: tag#1541 CDB: opcode=0xe5 (vendor) [ 2080.654374][ C0] sd 0:0:1:0: tag#1541 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2080.663423][ C0] sd 0:0:1:0: tag#1541 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2080.672585][ C0] sd 0:0:1:0: tag#1541 CDB[20]: ba [ 2080.679668][T30859] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:18 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x4, 0x1}, 0x100000) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) faccessat2(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x50, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x1000000, 0x80010, r3, 0x41ea7000) ppoll(0x0, 0x0, &(0x7f0000000200)={0x77359400}, &(0x7f0000000440)={[0x8000000000000001]}, 0x8) 17:22:18 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1400000000000000}]) 17:22:18 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2400, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2080.764819][T30859] loop5: detected capacity change from 0 to 4 [ 2080.779915][T30887] loop0: detected capacity change from 0 to 512 [ 2080.786298][T30859] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2080.793702][T30887] EXT4-fs (loop0): bad geometry: block count 1946157184 exceeds size of device (128 blocks) [ 2080.815628][ C1] sd 0:0:1:0: tag#1547 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2080.825485][ C1] sd 0:0:1:0: tag#1547 CDB: opcode=0xe5 (vendor) [ 2080.831839][ C1] sd 0:0:1:0: tag#1547 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2080.840879][ C1] sd 0:0:1:0: tag#1547 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2080.849905][ C1] sd 0:0:1:0: tag#1547 CDB[20]: ba 17:22:18 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1b00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2080.873133][ C0] sd 0:0:1:0: tag#1548 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2080.883011][ C0] sd 0:0:1:0: tag#1548 CDB: opcode=0xe5 (vendor) [ 2080.889383][ C0] sd 0:0:1:0: tag#1548 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2080.898430][ C0] sd 0:0:1:0: tag#1548 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2080.907444][ C0] sd 0:0:1:0: tag#1548 CDB[20]: ba 17:22:18 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800900000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2080.932937][T30887] loop0: detected capacity change from 0 to 512 [ 2080.940390][T30887] EXT4-fs (loop0): bad geometry: block count 1946157184 exceeds size of device (128 blocks) 17:22:18 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000007a06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2080.985377][T30909] loop5: detected capacity change from 0 to 4 [ 2080.993896][T30909] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2081.025125][T30916] loop0: detected capacity change from 0 to 512 17:22:18 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1500000000000000}]) [ 2081.031727][ C0] sd 0:0:1:0: tag#1586 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2081.041601][ C0] sd 0:0:1:0: tag#1586 CDB: opcode=0xe5 (vendor) [ 2081.047931][ C0] sd 0:0:1:0: tag#1586 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2081.056974][ C0] sd 0:0:1:0: tag#1586 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2081.066013][ C0] sd 0:0:1:0: tag#1586 CDB[20]: ba [ 2081.072048][T30916] EXT4-fs (loop0): bad geometry: block count 2046820480 exceeds size of device (128 blocks) 17:22:18 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2500, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:18 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800a00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:18 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800001ac06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:18 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1c00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2081.110054][T30909] loop5: detected capacity change from 0 to 4 [ 2081.122248][T30909] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2081.179587][T30936] loop5: detected capacity change from 0 to 4 [ 2081.181826][T30942] loop0: detected capacity change from 0 to 512 [ 2081.195350][T30936] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2081.204313][T30942] EXT4-fs (loop0): bad geometry: block count 2885746816 exceeds size of device (128 blocks) 17:22:18 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800b00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2081.246523][ C0] sd 0:0:1:0: tag#1553 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2081.256386][ C0] sd 0:0:1:0: tag#1553 CDB: opcode=0xe5 (vendor) [ 2081.262750][ C0] sd 0:0:1:0: tag#1553 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2081.271799][ C0] sd 0:0:1:0: tag#1553 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2081.280861][ C0] sd 0:0:1:0: tag#1553 CDB[20]: ba [ 2081.326271][ C1] sd 0:0:1:0: tag#1562 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2081.336148][ C1] sd 0:0:1:0: tag#1562 CDB: opcode=0xe5 (vendor) [ 2081.342495][ C1] sd 0:0:1:0: tag#1562 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2081.351528][ C1] sd 0:0:1:0: tag#1562 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2081.360563][ C1] sd 0:0:1:0: tag#1562 CDB[20]: ba [ 2081.413451][T30959] loop5: detected capacity change from 0 to 4 [ 2081.432582][T30959] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:19 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1600000000000000}]) 17:22:19 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800001ad06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:19 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2600, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:19 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800c00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1d00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:19 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x8802, 0x49) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000480)) sendmsg$inet(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000240)="c15a4000b1155e8a2ae4cc4d964e1437786311a350422948e54b3db9d800b623a5b3f40c5c60d4e372b501e524d9dad36a5bc92413f7d1338073e47b940c10d583aaa937998180c6c86dbe4e05261386e6e1195189adfaaf041eda9ca2191af82ba48cd1e6bfcd33d125765db36dc3eb2da40914b21496d00dacc067719c1093b4d4af8dd443a6df443b86185347be35f4e234c70dd4a782cdde47424dc59b8c48517df0a8f241289750312f3ad117ddc92164dc4f62c842c6e406a17cf663d9985b94fbacaec32e3e8be138ec22300403d558655af0bcfddc87", 0xda}, {&(0x7f0000000340)="963e842ad98c32dcd15369d74c40143981b8b09f928dfce4f9c44b8f8f61043ae3c1c109b899cba4ddbd9155b98f9dd8cb7dc01968", 0x35}, {&(0x7f0000000380)="db37e0059a81fdfea5688a14545647d9f9763f6fa95d319b1810ec16883b254130b6444cdfd537369424544e15aa1717cc9b7be8abd10c8d4a3a9b9f519977a37bf163341cf661461beab1ff61e81051dbe7bad984236eed4ab9053b0618d1", 0x5f}, {&(0x7f0000000680)="8d1db75e92f1860d05e18d1b5ac74f2ce3c00d33d1958fe2c65be9440590ed4534624c7a4cc6ba43e5e88459e7c1974778f3bbf847c242a593633f5782c7b32ae72f7cd632d24e1522f75131ab77a2601300541fe1e1cf65d342a55486582c5cc4d4975dfc9e06d305734cc5fbe3baa8dab50a3ca493684e0aa8582c16f35093adf9d22049ab5232670e9000a2f0e319212b4c", 0x93}, {&(0x7f0000000740)="a31bb8b07e920ff3749d98c801ccd5ad970ff5d30a2fd5c40edb273afe2da4805a68a074a3fbaad55dd8393b1b5f78c5993c1cb9f40c219975478a8b2572c1d98134c6656a92388eb9699c22fa4e76613924fbf6e0514a8d02061b4801698db05a526314110538527a23cd06173dfc6ea46e5fb930127431f77f06431f9c826ccb5a7861aab12e529983ad56a489c8dea56566710421dd8611b30da1209b7f72d94029c602d5e394bc474c97cd589b61dc3ad038f0113e4295e7fb0ca6d9899f953a42c70165e4bf0e736ec0c1", 0xcd}, {&(0x7f0000000840)="f26319a7f13329c9ff0ba1ff5ab0b0445c3bc8e8a813d3d08b3c76b9fd4c8a6a2ef4965b2649d50934782afd2b015a1ac32ffc88736d5004b926df0632ee79c0307cb31344793fbeb7a3dc24aa39b9f7de9b13cb2c6f89c6800bb8af71f0623abedf927a00d6d87c29c7b0857b2f99f97e49dcae47f0f11b5dc0d71aed", 0x7d}], 0x6}, 0x10) r4 = socket$inet6(0xa, 0x401000000001, 0x0) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x800100000001) r6 = socket$inet6(0xa, 0x401000000001, 0x0) close(r6) r7 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) setsockopt$sock_linger(r7, 0x1, 0xd, &(0x7f0000000980)={0x1, 0x4}, 0x8) r8 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x2500, 0x0) sendfile(r6, r8, 0x0, 0x800100000001) syz_io_uring_setup(0x3621, &(0x7f0000000040)={0x0, 0xf281, 0x1, 0x4, 0x24f, 0x0, r8}, &(0x7f0000003000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000009c0)=""/14, 0xe}, {&(0x7f0000000a00)=""/126, 0x7e}, {&(0x7f0000000a80)=""/15, 0xf}, {&(0x7f0000000ac0)=""/4096, 0x1000}], 0x4) [ 2081.608095][T30976] loop0: detected capacity change from 0 to 512 [ 2081.609352][T30978] loop5: detected capacity change from 0 to 4 [ 2081.640369][T30978] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:19 executing program 4: r0 = syz_io_uring_setup(0x7aeb, &(0x7f0000000140)={0x0, 0x0, 0x10}, &(0x7f0000002000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2081.654557][T30976] EXT4-fs (loop0): bad geometry: block count 2902524032 exceeds size of device (128 blocks) [ 2081.677924][ C1] sd 0:0:1:0: tag#1592 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2081.687784][ C1] sd 0:0:1:0: tag#1592 CDB: opcode=0xe5 (vendor) [ 2081.694149][ C1] sd 0:0:1:0: tag#1592 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2081.703195][ C1] sd 0:0:1:0: tag#1592 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2081.712246][ C1] sd 0:0:1:0: tag#1592 CDB[20]: ba [ 2081.739013][T30978] loop5: detected capacity change from 0 to 4 [ 2081.745467][T30976] loop0: detected capacity change from 0 to 512 [ 2081.754002][T30978] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1e00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:19 executing program 4: r0 = syz_io_uring_setup(0x17e2, &(0x7f0000000140)={0x0, 0xfffffffe}, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_SPLICE={0x1e, 0x0, 0x0, @fd_index=0x3, 0x401, {0x0, r0}, 0x1ff, 0x4, 0x0, {0x0, 0x0, r0}}, 0xee3) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x301100, 0x0) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e21, 0x7, @local, 0x494}, 0x1c) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x4, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r5}}, 0xffffffff) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r7 = socket$inet6(0xa, 0x401000000001, 0x0) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r7, r8, 0x0, 0x800100000001) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000280)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd_index=0x9, 0x0, 0x0, 0x2, 0x6, 0x0, {0x0, r5, r8}}, 0xf712) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:19 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800d00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:19 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2700, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2081.780257][T30976] EXT4-fs (loop0): bad geometry: block count 2902524032 exceeds size of device (128 blocks) 17:22:19 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000003000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:19 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x1700000000000000}]) 17:22:19 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003b306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2081.899681][T31031] loop5: detected capacity change from 0 to 4 [ 2081.909601][T31033] loop0: detected capacity change from 0 to 512 17:22:19 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x80000000, 0x2, 0x0, 0x800}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) r3 = syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_FSYNC={0x3, 0x3, 0x0, @fd_index=0x2, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x81) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r6, 0x0, &(0x7f0000000400)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, {0x1}}, 0xb2) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x74}]}) r8 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x8, 0x40012, r0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x18, 0x810, r3, 0x10000000) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f00000002c0)={0x2, &(0x7f0000000280)=[{0x6, 0x68, 0x4, 0x1}, {0x2, 0xc7, 0x1, 0x7fff}]}, 0x10) syz_io_uring_submit(r8, r2, &(0x7f00000000c0)=@IORING_OP_FILES_UPDATE={0x14, 0x2, 0x0, 0x0, 0x7, &(0x7f0000000080)=[0xffffffffffffffff], 0x1}, 0x7fff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000003c0)={0x3, &(0x7f0000000300)=[{0x9, 0x0, 0x2, 0x6e49}, {0xe8e, 0x0, 0x7f, 0x2}, {0x400, 0x20, 0x9, 0x7fff}]}) io_uring_enter(r0, 0x20a7, 0x0, 0x1, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2081.941562][T31031] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2081.952670][T31033] EXT4-fs (loop0): bad geometry: block count 3003318400 exceeds size of device (128 blocks) 17:22:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x1f00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:19 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x2000000000000000}]) 17:22:19 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0xd5a3, 0x2, 0xfffffffc}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000003000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000040), &(0x7f0000000080)={'U-', 0xebb3}, 0x16, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:19 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2800, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2082.035395][T31031] loop5: detected capacity change from 0 to 4 [ 2082.045136][T31031] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2082.054069][T31033] loop0: detected capacity change from 0 to 512 [ 2082.063895][T31033] EXT4-fs (loop0): bad geometry: block count 3003318400 exceeds size of device (128 blocks) 17:22:19 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800e00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:19 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000b606000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2000, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2082.180620][T31080] loop5: detected capacity change from 0 to 4 [ 2082.204127][T31090] loop0: detected capacity change from 0 to 512 17:22:19 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x2200000000000000}]) 17:22:19 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x404fc3, 0x0, 0x3, 0xab}, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2082.227171][T31080] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2082.240305][T31090] EXT4-fs (loop0): bad geometry: block count 3053453440 exceeds size of device (128 blocks) [ 2082.279508][T31080] loop5: detected capacity change from 0 to 4 [ 2082.288224][T31080] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:19 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001801000000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:19 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) write$binfmt_elf64(r3, &(0x7f0000000480)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x9, 0x5, 0x0, 0x3, 0x3, 0x3e, 0x8001, 0x3b9, 0x40, 0x3ca, 0x100, 0x20, 0x38, 0x2, 0x20, 0x89fd}, [{0x6474e556, 0x7f, 0xff, 0x3b, 0x2, 0x3f, 0x7fffffff, 0xffffffffffffff80}], "4e1caaf43a3b80bd13ae9d1d4063448b50de19290e752e7bf983b63188d021eb7973c35fbdaa8f5da0bc521077f0dadf6c6a516c910f576bdd8ade06a186fe508ea68d656fd64d5ed0877d8ff8a96bac23a82d39f5e58bcf98c64e571879114b8f918571c585a2173d31237aabbb16a5c1cf0a5ce19cf16e2f5260071578199a144d3a7bec72374eadda5e28ef35ad4ade866412b24dc2c398725d605a", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x715) [ 2082.346868][T31090] loop0: detected capacity change from 0 to 512 [ 2082.366476][T31090] EXT4-fs (loop0): bad geometry: block count 3053453440 exceeds size of device (128 blocks) 17:22:20 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2100, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2900, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2082.391533][T31121] loop5: detected capacity change from 0 to 4 17:22:20 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x3f00000000000000}]) 17:22:20 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001801100000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:20 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$BTRFS_IOC_DEFRAG_RANGE(r3, 0x40309410, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r4 = socket$inet6(0xa, 0x401000000001, 0x0) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x800100000001) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, 0x0) [ 2082.423840][T31121] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:20 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800002b806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:20 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2200, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2082.503675][T31150] loop5: detected capacity change from 0 to 4 [ 2082.526430][T31153] loop0: detected capacity change from 0 to 512 [ 2082.544347][T31150] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:20 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r1, r4, &(0x7f0000000040)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x5, 0x2000, @fd_index=0x5, 0x7, 0x0, 0x0, 0x12, 0x0, {0x2}}, 0x7) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r5, r2, &(0x7f0000000080)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x5, 0x0, 0x0, 0x0, 0x12345}, 0x4) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2082.568801][T31153] EXT4-fs (loop0): bad geometry: block count 3087138944 exceeds size of device (128 blocks) 17:22:20 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001801200000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:20 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x4000000000000000}]) [ 2082.621409][T31153] loop0: detected capacity change from 0 to 512 [ 2082.636876][T31153] EXT4-fs (loop0): bad geometry: block count 3087138944 exceeds size of device (128 blocks) [ 2082.652774][T31174] loop5: detected capacity change from 0 to 4 17:22:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2a00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2082.676727][T31174] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2082.709809][T31174] loop5: detected capacity change from 0 to 4 17:22:20 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800002b906000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:20 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) read(r0, &(0x7f0000000040)=""/146, 0x92) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2082.731333][T31174] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:20 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2300, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:20 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001801800000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:20 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xe4ffffff00000000}]) [ 2082.785338][T31194] loop0: detected capacity change from 0 to 512 [ 2082.801571][T31194] EXT4-fs (loop0): bad geometry: block count 3103916160 exceeds size of device (128 blocks) 17:22:20 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003bc06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:20 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = signalfd4(r0, &(0x7f0000000040)={[0x8]}, 0x8, 0x0) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x40000, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r3, 0x4, &(0x7f00000000c0)=r4, 0x1) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440)={[0xfffffffffffffffd]}, 0x8) 17:22:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2b00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2082.885997][T31206] loop5: detected capacity change from 0 to 4 [ 2082.897249][T31206] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2082.905480][T31217] loop0: detected capacity change from 0 to 512 [ 2082.920044][T31217] EXT4-fs (loop0): bad geometry: block count 3154313344 exceeds size of device (128 blocks) 17:22:20 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) recvmsg$unix(r3, &(0x7f00000001c0)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f00000000c0)=[{&(0x7f0000000240)=""/241, 0xf1}], 0x1, &(0x7f0000000480)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0xe8}, 0x40000000) [ 2082.969060][T31206] loop5: detected capacity change from 0 to 4 [ 2082.984812][T31206] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2082.991659][T31217] loop0: detected capacity change from 0 to 512 17:22:20 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2400, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2083.015322][T31217] EXT4-fs (loop0): bad geometry: block count 3154313344 exceeds size of device (128 blocks) 17:22:20 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) mlock2(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1) r4 = socket$inet6(0xa, 0x401000000001, 0x0) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x800100000001) io_uring_register$IORING_REGISTER_EVENTFD(r5, 0x4, &(0x7f0000000040)=r3, 0x1) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:20 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001801c00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:20 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xf4ffffff00000000}]) 17:22:20 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800001c206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2083.107251][T31257] loop5: detected capacity change from 0 to 4 17:22:20 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x7d64, 0x0, 0xffffffff}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x10}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4200, r3, 0x0, 0x0) tkill(0x0, 0x38) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000240)="84b802b68722630cc22b62dd2e69ca690706170b8b25b272f3c05bbcf170335a7212edc7144d3939c13b") ptrace$cont(0x9, 0x0, 0x0, 0x0) ptrace$poke(0x4, 0x0, &(0x7f00000001c0), 0x5) tkill(r3, 0x38) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r3, 0x0, 0x0) r4 = socket$inet6(0xa, 0x401000000001, 0x0) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4800, 0x0) sendfile(r4, r5, 0x0, 0x800100000001) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x7, 0xe0, 0x9, 0x81, 0x0, 0xfffffffffffbfffd, 0x204, 0x2, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfffffff9, 0x0, @perf_bp={&(0x7f0000000040), 0x7}, 0xc40, 0x4000000000fdad, 0x293b, 0x2, 0x4, 0x3, 0x400, 0x0, 0x4, 0x0, 0xfffffffffffffffb}, r3, 0x200000000000009, r5, 0x8) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2083.149202][T31257] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:20 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2500, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:20 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_setup(0x174f, &(0x7f0000000040)={0x0, 0x761c, 0x4, 0x2, 0x11b, 0x0, r0}, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000000c0)=0x0, &(0x7f00000001c0)) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r6 = openat$incfs(0xffffffffffffffff, &(0x7f0000000240)='.pending_reads\x00', 0x200400, 0x20) syz_io_uring_submit(r3, r5, &(0x7f00000003c0)=@IORING_OP_STATX={0x15, 0x4, 0x0, r6, &(0x7f0000000280), &(0x7f0000000380)='./file0\x00', 0x800, 0x0, 0x1}, 0x100000) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2c00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2083.195867][T31272] loop0: detected capacity change from 0 to 512 [ 2083.216022][T31257] loop5: detected capacity change from 0 to 4 [ 2083.224669][T31272] EXT4-fs (loop0): bad geometry: block count 3254845568 exceeds size of device (128 blocks) [ 2083.237321][T31257] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:20 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001802500000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:20 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003c806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:20 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xfbffffff00000000}]) 17:22:20 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2600, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2083.333254][T31300] loop0: detected capacity change from 0 to 512 [ 2083.350749][T31300] EXT4-fs (loop0): bad geometry: block count 3355639936 exceeds size of device (128 blocks) [ 2083.364825][T31311] loop5: detected capacity change from 0 to 4 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x8010, r0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r3, r5, &(0x7f00000000c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x2007, @fd_index=0x9, 0x3, &(0x7f0000000080)=[{&(0x7f0000000240)="606f24208f9a9b6163a4c5a2953bc295c669e1cf57a5f80fd6b68a783dde6110c4e3666b24630b1e34eef61b34c498c176fd5d7172ef283e8f5eea01a92a46a349e3a9633ce052609e0d2d9931505b08485a202d9b133ae50244d17486f9aa5f4d2c3562003980e3f248143a100f8389205d3053614b5971188002d7434ea802465dea6c04ccdc40bedb59cb7c09d43f0b7422e8c26fbfce9023ac61e41e5495225b8c172c1f1b108a6c426f8915c89a91b2674e39064ddbb3f5940dd3087615d19d59fe606a5f8d482258aebb", 0xcd}, {&(0x7f0000000480)="b97a87117567cf9e7673e202cc70a72c686c28742db2b5c95aba0d2ae235ea354f0a3d09c0d0bdb7701383582f020ac5847c9da3672be12396cf010ac099a0afb9e7302fcbf28ddda82d90eb99ac2a01368b69c9728f8552290f01e884a221400fcddb18025ed60407e53aa3841cd36c993832c78d8589252ed92b1a857c0722776cf017b20568b9562870c9b6c4b9a2c797a9fd5b2aceca9214497ee0804ad26fb727a1a33f41e836032ebc5b51ef00d911d9a2a15f9568f7f07933792ed1d3681c7d780a06ab41ce9557306125ed24fa91", 0xd2}, {&(0x7f0000000040)="81cbed2392fa185db8ee66092a0b48b76b8206868b6de00db0d3c9", 0x1b}, {&(0x7f0000000340)="43f4c01e9da62991f67b757c9c7186186dca70efca739f5070ffa6d892382b25cf85d2a5dfb47315c730dfed6d7ac400de4dbb68a9fc441b22436402385bbec400794490b9a749cf9bc2990561232c4ea75f8865c9007c3fd7a3c120c074c2aab53a01892177970fd191c0d3cf3f7ae16a0d2059e5800be94911c84e8a405e6c06ea10a2d0eb69037d004348471017f117a99ae237dc614d5a0f594968929b8d7fb24e66cb5d1b", 0xa7}], 0x4, 0x14, 0x1, {0x1}}, 0xfff) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2083.385120][T31311] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x100}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) accept4(r3, &(0x7f0000000040)=@l2tp={0x2, 0x0, @local}, &(0x7f00000000c0)=0x80, 0x0) 17:22:21 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2d00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2083.432396][T31300] loop0: detected capacity change from 0 to 512 [ 2083.450228][T31311] loop5: detected capacity change from 0 to 4 [ 2083.466687][T31300] EXT4-fs (loop0): bad geometry: block count 3355639936 exceeds size of device (128 blocks) 17:22:21 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2700, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:21 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xfeffffff00000000}]) 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_CLOSE={0x13, 0x2, 0x0, r0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2083.483194][T31311] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:21 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003ca06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:21 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001802600000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2083.593028][T31356] loop0: detected capacity change from 0 to 512 [ 2083.593593][T31358] loop5: detected capacity change from 0 to 4 [ 2083.630248][T31358] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x2, 0x3, 0x245}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000002000/0x4000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r5 = socket$inet6(0xa, 0x401000000001, 0x0) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x800100000001) syz_io_uring_submit(r3, r2, &(0x7f0000000900)=@IORING_OP_SENDMSG={0x9, 0x4, 0x0, r6, 0x0, &(0x7f00000008c0)={&(0x7f0000000040)=@nl=@unspec, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000240)="986beb52ba3320bf4d05b1160b8a028d88d7a4efe6e32c142c183370aa9a721313561fe3eeec890b33f9d39fa54d836395938c1217c6f75163c07156fe4e04e4488f7603b6be28277a2923f64d9bb752c523629837f4bddef4dad87f05be76829ee373902f2e3c61a243c2253415a1a0262ba648", 0x74}, {&(0x7f00000002c0)="8c9847fb482f4783b1d2bb828b497a2be6323551adb02c9430a561145a18f41ff5b3b012c06f7cfc205ca4d47c6b161b5fe0b5c70a79038aa8db208c16df8f64475cd0ff33c929ce2d49ce10b44cba81b0dbb953d79b651d9ca7bb7654ef975f454e0ecbf1f064a73a2108cd8bd541ee48378878f50bdaf0bcb78b47351d9658346de2ae4d069ff090e5bb881eb3bd52df61d5d347ac75a5fe5c375b72058e3e7866b8a1ee23e03d2d2a1cd03674004aa67e0428c104b0dab1a2e87174458ee49990fbc72e0434e6d2884311761289e392c606ad11ca6d9757ef05050452b7b21e7c713d80463c2e19c13b7c8760535137f43867", 0xf4}, {&(0x7f0000000480)="a504859cdff59ecb6824e4248f087837a2d09901a508a063ba845808743e67b6097a2f60b1570a9f0a87b2bcc0d535e4f046854b13a543c764b5f606d94fc592873d1579082734f286ee992886edd92f2df2a1dbe5f49f776c68d44a7afcd8f9c36a63b81517bd42db28da7cb62278d488c0053cdd102bdeb9d24ee183ba603f8ba4285af112e690359109023636c1b969e4bffbfd6c02397cac863e8b680ea0174f6a418bfa826ea3dfa565472b36855942e3150a10dcc5bf669f7b95a5b313c6316481dee64cd43725", 0xca}, {&(0x7f00000000c0)}, {&(0x7f0000000580)="ab83159d3f4edc8438925b5f9ae7937a61d13763232049fbacbbace1a5ae8e24e12fc2db57bf37737600242d87490b49cab7f1652b626a8c677e4f27a9128715ddb95aa480cee227d69b1db8c43455fb9b38642513bcce98b41e44ca5e738c6b9a5209a664671533c685b0d6b20e70ec36b669e7e44a9a00a55890cf86df0d3c15262188093856705428325c4dba037b", 0x90}, {&(0x7f00000001c0)="4823d180930304afd092aa445bab9625e6435e92e9280d5d2c2a674f0c04", 0x1e}, {&(0x7f00000003c0)="96f5054ad36c8360a1f2365c60e749fdd65d2801f01546d00db0", 0x1a}, {&(0x7f0000000640)="44054b11dcfc6781d97d85715491dccd611e7af6d8b4031f7f99f93de290542200fe5a6af9a73b0b0d756b6d85095b4ee839320db4283a1c6eadefb02a0f9d4d620f5cd25de534b8a57409aca187830a478cc081d7de9cda0e917f28512433223d", 0x61}, {&(0x7f00000006c0)="5d4d75ecddb8c51cab294876f4d3c19c9f63b533e68278e9adc261c77fa1cb18c65cc6c16697e5e6c8693cce237c769c2646b22a7b24f2db28e023c289570eaab61ec85143f6ee57f94b9f06f8", 0x4d}, {&(0x7f0000000740)="449eeb389a91f7bc29a9b3409ac3017ea803bf94384dc164c6f1a54c6955c350c4343b185c0d240ef9604ed6daf6d63d4dfd9c70dbc91e02604b40538a7935bfdabd69ffca725daf6785be9a756051240b50aff0893ecdbde7e0673e031feb40b15368cf5623f8824a4d5546311933", 0x6f}], 0xa, &(0x7f0000000880)}, 0x0, 0x1}, 0x20) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:21 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001804800000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2083.643109][T31356] EXT4-fs (loop0): bad geometry: block count 3389194368 exceeds size of device (128 blocks) 17:22:21 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xff01000000000000}]) 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e8, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:21 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2800, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:21 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2e00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2083.716319][T31356] loop0: detected capacity change from 0 to 512 [ 2083.747081][T31356] EXT4-fs (loop0): bad geometry: block count 3389194368 exceeds size of device (128 blocks) 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = accept$packet(r3, 0x0, &(0x7f0000000040)) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r7 = socket$inet6(0xa, 0x401000000001, 0x0) close(r7) r8 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r7, r8, 0x0, 0x800100000001) syz_io_uring_submit(r1, r6, &(0x7f0000000340)=@IORING_OP_OPENAT2={0x1c, 0x4, 0x0, r8, &(0x7f0000000240)={0x418240, 0xe0, 0x1e}, &(0x7f0000000280)='./file0\x00', 0x18, 0x0, 0x12345}, 0x1) r9 = socket$inet6(0xa, 0x401000000001, 0x0) close(r9) r10 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r9, r10, 0x0, 0x800100000001) fsetxattr$security_evm(r9, &(0x7f00000001c0), &(0x7f00000002c0)=ANY=[@ANYBLOB="0296a3bfff000000001535b9c16a7a033674951fd16e0d3fe7d2d3cb8de302fcc549d15c33539160dd82ebff441570291a712e7d78587551d45434964d5b87517ec8ec6e61c7933accffc920bd942e0e000000000000af6943af2003b82cfa126df9742a04758ab4"], 0xd, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(r4, 0x1, 0x53, &(0x7f0000000080)={0x7, 0x7, 0x4}, &(0x7f00000000c0)=0x28) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:21 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003ce06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2083.775327][T31386] loop5: detected capacity change from 0 to 4 [ 2083.798927][T31386] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2083.846129][T31404] loop0: detected capacity change from 0 to 512 [ 2083.857845][T31386] loop5: detected capacity change from 0 to 4 [ 2083.870992][T31404] EXT4-fs (loop0): bad geometry: block count 3456303232 exceeds size of device (128 blocks) [ 2083.882378][T31386] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:21 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xff0f000000000000}]) 17:22:21 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003ed06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) mmap(&(0x7f0000ff1000/0xf000)=nil, 0xf000, 0x4, 0x8010, r0, 0xf10f8000) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x100010, r3, 0x24d74000) 17:22:21 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2900, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:21 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001804c00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) r3 = fsmount(0xffffffffffffffff, 0x1, 0xfc) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x10000000) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2084.006418][T31429] loop0: detected capacity change from 0 to 512 [ 2084.026773][T31429] EXT4-fs (loop0): bad geometry: block count 3976396928 exceeds size of device (128 blocks) [ 2084.034459][T31438] loop5: detected capacity change from 0 to 4 [ 2084.049604][T31438] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:21 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2a00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:21 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xffefffff00000000}]) 17:22:21 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003f206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:21 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2f00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2084.090944][T31438] loop5: detected capacity change from 0 to 4 [ 2084.129419][T31438] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:21 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001806800000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2084.161231][T31459] loop0: detected capacity change from 0 to 512 [ 2084.189248][T31459] EXT4-fs (loop0): bad geometry: block count 4060283008 exceeds size of device (128 blocks) 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x203a, 0x58f5, 0x0, &(0x7f00000000c0)={[0x100000001]}, 0x8) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r5 = mmap$IORING_OFF_SQES(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x8, 0x10, r0, 0x10000000) syz_io_uring_submit(r3, r5, &(0x7f0000000080)=@IORING_OP_TIMEOUT={0xb, 0x2, 0x0, 0x0, 0x4, &(0x7f0000000040), 0x1, 0x0, 0x1}, 0x6) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = syz_io_uring_setup(0x187, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {}, 0x0, {0x0, r9}}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f0000000240)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x5, 0x0, @fd=r0, 0xee, 0x0, 0x5f, 0xc, 0x1, {0x0, r9}}, 0x4) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2084.217665][T31471] loop5: detected capacity change from 0 to 4 [ 2084.225766][T31471] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2084.250869][T31459] loop0: detected capacity change from 0 to 512 17:22:21 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2b00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:21 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001806c00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2084.261702][T31459] EXT4-fs (loop0): bad geometry: block count 4060283008 exceeds size of device (128 blocks) 17:22:21 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003f406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:21 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xffffffff00000000}]) [ 2084.306609][T31491] loop5: detected capacity change from 0 to 4 [ 2084.315567][T31491] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:21 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000400)) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2084.382048][T31491] loop5: detected capacity change from 0 to 4 [ 2084.389445][T31504] loop0: detected capacity change from 0 to 512 [ 2084.401565][T31491] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:22 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x2}, &(0x7f0000002000/0x3000)=nil, &(0x7f0000003000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = mmap$IORING_OFF_SQES(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x5, 0x4000010, r3, 0x10000000) r5 = socket$inet6(0xa, 0x401000000001, 0x0) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x800100000001) syz_io_uring_submit(r1, r4, &(0x7f0000000080)=@IORING_OP_READ_FIXED={0x4, 0x2, 0x6000, @fd=r6, 0x100000000, 0x0, 0x4, 0x0, 0x0, {0x2}}, 0x7ff) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:22 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001807400000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:22 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2c00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2084.428202][T31504] EXT4-fs (loop0): bad geometry: block count 4093837440 exceeds size of device (128 blocks) [ 2084.493411][T31526] loop5: detected capacity change from 0 to 4 [ 2084.502015][T31504] loop0: detected capacity change from 0 to 512 [ 2084.529153][T31504] EXT4-fs (loop0): bad geometry: block count 4093837440 exceeds size of device (128 blocks) 17:22:22 executing program 4: r0 = socket$inet6(0xa, 0x401000000001, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='\x00', 0x800, 0x0) sendfile(r0, r1, 0x0, 0x800100000001) ioctl$BTRFS_IOC_QGROUP_ASSIGN(r0, 0x40189429, &(0x7f0000000040)={0x1, 0x0, 0x6}) r2 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r2, 0x0, 0x0}, 0x0) io_uring_enter(r2, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:22 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xffffffffff600000}]) [ 2084.540025][T31526] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:22 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800003fa06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:22 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001807a00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3100, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:22 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2d00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2084.640484][T31556] loop0: detected capacity change from 0 to 512 [ 2084.671361][T31556] EXT4-fs (loop0): bad geometry: block count 4194500736 exceeds size of device (128 blocks) [ 2084.676585][T31559] loop5: detected capacity change from 0 to 4 17:22:22 executing program 4: r0 = syz_io_uring_setup(0x685a, &(0x7f0000000240)={0x0, 0x940f, 0x20, 0xfffffffd}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x9) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) io_uring_enter(r0, 0x58e6, 0x17d8, 0x2, &(0x7f0000000040)={[0x4]}, 0x8) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x104, &(0x7f00000001c0)=0x1, 0x0, 0x4) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r7 = syz_io_uring_setup(0x187, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index, 0x0, 0x0, 0x0, {}, 0x0, {0x0, r10}}, 0x0) syz_io_uring_submit(r3, r6, &(0x7f00000002c0)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x1, 0x0, 0xffffffffffffffff, 0x0, r0, 0x2, 0x0, 0x1, {0x0, r10}}, 0x800) close(0xffffffffffffffff) r11 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_FSYNC={0x3, 0x6, 0x0, @fd_index=0x2, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x8) signalfd(r11, &(0x7f0000000100)={[0x2c4]}, 0x8) write$cgroup_freezer_state(r11, &(0x7f0000000180)='THAWED\x00', 0x7) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2084.727527][T31559] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:22 executing program 4: r0 = syz_io_uring_setup(0x39c2, &(0x7f0000000140)={0x0, 0xcb8, 0x10, 0x2}, &(0x7f0000002000/0x3000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) readahead(r3, 0x80000001, 0x3ff) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:22 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0xffffffffffffffff}]) [ 2084.768203][T31556] loop0: detected capacity change from 0 to 512 [ 2084.768246][T31559] loop5: detected capacity change from 0 to 4 [ 2084.780997][T31556] EXT4-fs (loop0): bad geometry: block count 4194500736 exceeds size of device (128 blocks) [ 2084.816815][T31559] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:22 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fe00000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:22 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2e00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:22 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800001fc06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:22 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0xfffffffc) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x8, 0x200) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r2, &(0x7f0000000080)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd=r5, 0x0, 0x0, 0xffffffff, 0xc, 0x1, {0x0, r6, r0}}, 0xfffff001) close(0xffffffffffffffff) syz_io_uring_setup(0x468c, &(0x7f0000000240)={0x0, 0x7738, 0x0, 0x3, 0x25b, 0x0, r0}, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f00000000c0)=0x0, &(0x7f00000002c0)) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r8, r9, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r7, r9, &(0x7f0000000300)=@IORING_OP_WRITE_FIXED={0x5, 0x5, 0x6000, @fd_index=0x9, 0x40, 0x1, 0x2, 0x4, 0x0, {0x2}}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2084.928669][T31604] loop5: detected capacity change from 0 to 4 [ 2084.957271][T31604] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2084.965029][T31611] loop0: detected capacity change from 0 to 512 17:22:22 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000}]) [ 2084.983688][T31611] EXT4-fs (loop0): bad geometry: block count 4227924096 exceeds size of device (128 blocks) [ 2084.998847][T31604] loop5: detected capacity change from 0 to 4 [ 2085.020329][T31604] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:22 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x5, 0x3, &(0x7f0000000480)=[{&(0x7f0000000240)="e03d9d17554c23b89ea6fc384fb207adbc2202a23c41008416fe565ba5c0afc643c5a70fd737e2475479932ca25e386799518c11e4df34ac6f81c9a2866aca9f400206148d2fc976913ad9fb719732979c1275b210069969680db37124184cebc3751355e951ed558aa2cd3d158c544fd3a3de3e7100e101473ca976dbfecc3f5a05cd66d67c69c2c4dbe0eba10e5b2dd3753c769ab9a1fe6e72561b99300ceede80435327ce42a94a93967023b2c7a5c33d443ab13af4fb446b", 0xba, 0x8001}, {&(0x7f0000000300)="be4322958d8470cee02a346e14248c3957abafabb648e78ef7e9a2f8f1a3263c2347865295516576057927c83be85a89f5baddf32fc93a788b80c2050ed6502f3bb33ed62d4c7f48298b8de17c2f07a09efbc73e78c3363b3bf929ab60cd24c68a3832afa0c068594df25da842c97305d3d55e6fd42ad138d6a1a9063ca620b878e89fefaa529ad13f1576091cba1498ef294c7493f445a20013f37010526d37945a19", 0xa3, 0x100}, {&(0x7f00000000c0)="285f596fa400b600e580a00c7bc3b38da95f7465f7b19842df668208425294995f432e64c63f86ecfc6fa2062a389b698f6897f6b3a7f75ba875bf299b075940", 0x40, 0x3e6}], 0x1000000, &(0x7f0000000500)={[{@dioread_nolock}, {@data_journal}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@quota}, {@nobarrier}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x7f}}, {@dax}, {@noacl}, {@jqfmt_vfsv1}, {@errors_continue}], [{@appraise_type}, {@mask={'mask', 0x3d, 'MAY_EXEC'}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@appraise_type}, {@smackfstransmute={'smackfstransmute', 0x3d, '$-\\('}}, {@measure}, {@appraise}]}) name_to_handle_at(r3, &(0x7f00000001c0)='./file0\x00', &(0x7f00000003c0)=@shmem={0xc, 0x1, {0x7fff, 0x6}}, &(0x7f0000000640), 0x1000) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:22 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800402000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3200, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2085.038862][T31611] loop0: detected capacity change from 0 to 512 [ 2085.058582][T31611] EXT4-fs (loop0): bad geometry: block count 4227924096 exceeds size of device (128 blocks) 17:22:22 executing program 4: sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)={0xe4, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_QOS_MAP={0x20, 0xc7, {[{0x2, 0x2}, {0x40, 0x4}, {0x3f}, {0x80, 0x5}, {0x5, 0x2}, {0x4, 0x4}, {0x4e, 0x5}, {0x2, 0x1}, {0x1, 0x6}, {0x3, 0x7}], "02c65407c312f7d5"}}, @NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0xff, 0x3}, {0x5, 0x6}, {0xaf, 0x3}, {0x3f, 0x6}, {0x2, 0x3}, {0x1}], "fd378378fae5f838"}}, @NL80211_ATTR_QOS_MAP={0x28, 0xc7, {[{0x2, 0x6}, {0x0, 0x7}, {0x7f, 0x6}, {0x80}, {0x3, 0x6}, {0x8, 0x6}, {0xe2}, {0x1}, {0x9, 0x4}, {0x39, 0x3}, {0x9e}, {0x7, 0x7}, {0x40}, {0x7f, 0x3}], "abeaa882a80ded00"}}, @NL80211_ATTR_QOS_MAP={0x2e, 0xc7, {[{0xf3, 0x5}, {0x9, 0x6}, {0x5, 0x5}, {0xe3, 0x2}, {0xff, 0x2}, {0x87, 0x7}, {0x99, 0x2}, {0x7f, 0x7}, {0x3f, 0x7}, {0x5, 0x1}, {0xe3, 0x6}, {0x9e, 0x2}, {0x29}, {0xd7, 0x5}, {0x5, 0x1}, {0x1, 0x5}, {0xf9, 0x6}], "f655588df25aad87"}}, @NL80211_ATTR_QOS_MAP={0x26, 0xc7, {[{0x1, 0x2}, {0x9, 0x3}, {0x0, 0x6}, {0x6}, {0x6, 0x5}, {0x1, 0x2}, {0x6}, {0x3, 0x1}, {0x8, 0x5}, {0x6a, 0x4}, {0x10, 0x2}, {0xf8, 0x7}, {0x40, 0x1}], "2b39fd432c31f99c"}}, @NL80211_ATTR_QOS_MAP={0xe, 0xc7, {[{0x40, 0x2}], "09fba11797918f3b"}}]}, 0xe4}, 0x1, 0x0, 0x0, 0x4000800}, 0x4020101) r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000003000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) fcntl$F_SET_FILE_RW_HINT(r4, 0x40e, &(0x7f0000000340)=0x4) 17:22:22 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000fffe06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2085.126775][T31650] loop5: detected capacity change from 0 to 4 [ 2085.145425][T31650] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:22 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x2f00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:22 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x2}]) 17:22:22 executing program 4: ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x3c, 0x0, 0x20, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r0}, @void}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98a}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xc}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x24}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000001}, 0x4000) r1 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r1, 0x0, 0x0}, 0x0) io_uring_enter(r1, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2085.218486][T31650] loop5: detected capacity change from 0 to 4 [ 2085.232380][T31674] loop0: detected capacity change from 0 to 512 [ 2085.239432][T31650] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2085.252553][T31674] EXT4-fs (loop0): bad geometry: block count 4278124672 exceeds size of device (128 blocks) 17:22:22 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800003000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2085.299146][T31674] loop0: detected capacity change from 0 to 512 [ 2085.313018][T31674] EXT4-fs (loop0): bad geometry: block count 4278124672 exceeds size of device (128 blocks) [ 2085.347110][ C1] scsi_io_completion_action: 30 callbacks suppressed [ 2085.347133][ C1] sd 0:0:1:0: tag#1576 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2085.363654][ C1] sd 0:0:1:0: tag#1576 CDB: opcode=0xe5 (vendor) [ 2085.369997][ C1] sd 0:0:1:0: tag#1576 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2085.379060][ C1] sd 0:0:1:0: tag#1576 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2085.388107][ C1] sd 0:0:1:0: tag#1576 CDB[20]: ba 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x417e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) io_uring_enter(r0, 0x20a4, 0x50e4, 0x0, 0x0, 0xfffffee4) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:23 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3000, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2085.403566][T31697] loop5: detected capacity change from 0 to 4 17:22:23 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:23 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000fff06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x17ee, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) fstat(r3, &(0x7f0000000040)) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2085.465822][T31697] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:23 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800204000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2085.508971][T31697] loop5: detected capacity change from 0 to 4 [ 2085.519292][T31697] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2085.527875][T31721] loop0: detected capacity change from 0 to 512 [ 2085.542204][T31721] EXT4-fs (loop0): bad geometry: block count 4279173248 exceeds size of device (128 blocks) 17:22:23 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x3}]) [ 2085.579793][ C1] sd 0:0:1:0: tag#1557 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2085.589638][ C1] sd 0:0:1:0: tag#1557 CDB: opcode=0xe5 (vendor) [ 2085.589930][T31739] loop5: detected capacity change from 0 to 4 [ 2085.595965][ C1] sd 0:0:1:0: tag#1557 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2085.611060][ C1] sd 0:0:1:0: tag#1557 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2085.620111][ C1] sd 0:0:1:0: tag#1557 CDB[20]: ba 17:22:23 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3100, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2085.621164][ C0] sd 0:0:1:0: tag#1558 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2085.635063][ C0] sd 0:0:1:0: tag#1558 CDB: opcode=0xe5 (vendor) [ 2085.641428][ C0] sd 0:0:1:0: tag#1558 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2085.650470][ C0] sd 0:0:1:0: tag#1558 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2085.659511][ C0] sd 0:0:1:0: tag#1558 CDB[20]: ba [ 2085.669014][T31739] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000004, 0x30, r3, 0x0) syz_io_uring_submit(r4, r2, &(0x7f00000001c0)=@IORING_OP_FSYNC={0x3, 0x3, 0x0, @fd=r0}, 0x1e4) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r5 = socket$inet6(0xa, 0x401000000001, 0x0) close(r5) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x1}, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r3, 0xc08c5336, &(0x7f0000000240)={0x3, 0x7ff, 0x0, 'queue1\x00', 0xffff}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xe, 0x110, r3, 0xe17aa000) r6 = accept4$inet(r3, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000000c0)=0x10, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x81f8943c, &(0x7f0000000680)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x800100000001) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000040)={0x4, 0x6, 0xa28, 0xfd62, 0x400}) 17:22:23 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x4}]) [ 2085.750647][T31721] loop0: detected capacity change from 0 to 512 [ 2085.767963][T31739] loop5: detected capacity change from 0 to 4 [ 2085.777070][T31721] EXT4-fs (loop0): bad geometry: block count 4279173248 exceeds size of device (128 blocks) 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) openat(r4, 0x0, 0x800, 0x1) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2085.796882][T31739] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2085.818634][ C1] sd 0:0:1:0: tag#1538 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2085.828490][ C1] sd 0:0:1:0: tag#1538 CDB: opcode=0xe5 (vendor) [ 2085.834819][ C1] sd 0:0:1:0: tag#1538 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_setup(0x2d19, &(0x7f0000000080)={0x0, 0x1b6c, 0x1b, 0x0, 0x36}, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000240), &(0x7f0000000280)) r5 = socket$nl_audit(0x10, 0x3, 0x9) syz_io_uring_submit(r3, r2, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x6, 0x0, @fd=r5, 0x0, 0x0, 0x0, {0x10}, 0x1}, 0x7) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2085.843866][ C1] sd 0:0:1:0: tag#1538 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2085.852905][ C1] sd 0:0:1:0: tag#1538 CDB[20]: ba 17:22:23 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000feff06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:23 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3200, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:23 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3400, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:23 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800604000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) munlock(&(0x7f0000002000/0x4000)=nil, 0x4000) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) ioctl$FIONCLEX(r0, 0x5450) 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x5, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2085.978621][T31787] loop0: detected capacity change from 0 to 512 [ 2086.014500][T31787] EXT4-fs (loop0): bad geometry: block count 4294836352 exceeds size of device (128 blocks) 17:22:23 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x5}]) [ 2086.032070][T31802] loop5: detected capacity change from 0 to 4 [ 2086.059981][ C1] sd 0:0:1:0: tag#1536 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2086.069840][ C1] sd 0:0:1:0: tag#1536 CDB: opcode=0xe5 (vendor) [ 2086.076187][ C1] sd 0:0:1:0: tag#1536 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2086.080785][T31802] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2086.085238][ C1] sd 0:0:1:0: tag#1536 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2086.100078][ C0] sd 0:0:1:0: tag#1537 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2086.100822][ C1] sd 0:0:1:0: tag#1536 CDB[20]: ba [ 2086.115743][ C0] sd 0:0:1:0: tag#1537 CDB: opcode=0xe5 (vendor) [ 2086.122100][ C0] sd 0:0:1:0: tag#1537 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 17:22:23 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3300, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) close_range(r4, 0xffffffffffffffff, 0x0) [ 2086.131170][ C0] sd 0:0:1:0: tag#1537 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2086.140211][ C0] sd 0:0:1:0: tag#1537 CDB[20]: ba 17:22:23 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) io_uring_enter(0xffffffffffffffff, 0x590b, 0x4af4, 0x3, &(0x7f0000000040)={[0x55b]}, 0x8) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:23 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000e010000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2086.206922][T31787] loop0: detected capacity change from 0 to 512 [ 2086.213578][T31802] loop5: detected capacity change from 0 to 4 [ 2086.228843][T31787] EXT4-fs (loop0): bad geometry: block count 4294836352 exceeds size of device (128 blocks) [ 2086.242124][T31802] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:23 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3500, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:23 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x6}]) [ 2086.289887][ C1] sd 0:0:1:0: tag#1590 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2086.299854][ C1] sd 0:0:1:0: tag#1590 CDB: opcode=0xe5 (vendor) [ 2086.306189][ C1] sd 0:0:1:0: tag#1590 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2086.315244][ C1] sd 0:0:1:0: tag#1590 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2086.324291][ C1] sd 0:0:1:0: tag#1590 CDB[20]: ba 17:22:23 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001808004000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:24 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3400, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2086.381442][T31850] loop0: detected capacity change from 0 to 512 [ 2086.401909][T31855] loop5: detected capacity change from 0 to 4 [ 2086.420689][ C1] sd 0:0:1:0: tag#1559 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 17:22:24 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f00000005c0)={0x0, 0x6197, 0x0, 0x1, 0x13a}, &(0x7f0000003000/0x2000)=nil, &(0x7f0000003000/0x4000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000500)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000580)=@IORING_OP_TIMEOUT={0xb, 0x5, 0x0, 0x0, 0x8, &(0x7f0000000540), 0x1, 0x1}, 0x8000) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x404020, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) mount_setattr(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x100, &(0x7f0000000080)={0x70, 0x100000, 0x20000, {r4}}, 0x20) prlimit64(0x0, 0x9, &(0x7f0000000380), 0x0) mremap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000004000/0x3000)=nil) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) syz_io_uring_setup(0x1b12, &(0x7f0000000240)={0x0, 0x6a75, 0x2, 0x0, 0x1c5, 0x0, r0}, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000003000/0x4000)=nil, &(0x7f00000000c0), &(0x7f00000001c0)=0x0) r6 = syz_open_dev$vcsu(&(0x7f00000002c0), 0x400000004, 0x80000) r7 = creat(&(0x7f0000000340)='./file0\x00', 0x24) write(r4, &(0x7f0000000480)="07f303aff1542ba6b91b7d81d2d039f0e1b2a5bf6be11ddc30d311ffad0c11b5c7c1de17729bb4ed720366c4584823cdc478eb66931630be44772e9ef10c4f0b5436a1f944bedc84643d8eafa4ef149121db545703078b88c076355068c4e3c3f17ce3f12503a15e9e", 0x69) syz_io_uring_submit(r1, r5, &(0x7f00000003c0)=@IORING_OP_EPOLL_CTL=@mod={0x1d, 0x3, 0x0, r6, &(0x7f0000000300)={0x4}, r7}, 0xffff) sync_file_range(0xffffffffffffffff, 0xe2, 0x8, 0x2) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2086.430658][ C1] sd 0:0:1:0: tag#1559 CDB: opcode=0xe5 (vendor) [ 2086.436994][ C1] sd 0:0:1:0: tag#1559 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2086.439196][T31855] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2086.446035][ C1] sd 0:0:1:0: tag#1559 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2086.446056][ C1] sd 0:0:1:0: tag#1559 CDB[20]: ba 17:22:24 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x350b, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2086.504546][T31850] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:24 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000005000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2086.574257][ C0] sd 0:0:1:0: tag#1592 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2086.584141][ C0] sd 0:0:1:0: tag#1592 CDB: opcode=0xe5 (vendor) [ 2086.590554][ C0] sd 0:0:1:0: tag#1592 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2086.599611][ C0] sd 0:0:1:0: tag#1592 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2086.608669][ C0] sd 0:0:1:0: tag#1592 CDB[20]: ba 17:22:24 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r3 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000480)={0x4, 0x6, 0x1, 0x1, 0x8, [{0xffffffff, 0x100000000, 0x9, '\x00', 0x82}, {0x1, 0xfffffffffffffffb, 0x9, '\x00', 0x2}, {0x96, 0x1, 0x1, '\x00', 0x70d}, {0x416f, 0x3, 0x5}, {0x100000001, 0x1, 0xb1, '\x00', 0x305}, {0x8001, 0xfffffffffffffffc, 0x6, '\x00', 0x1002}, {0xfffffffffffffe83, 0x0, 0x6, '\x00', 0x400}, {0x40, 0x8, 0x3, '\x00', 0x84}]}) r4 = socket(0x27, 0xa, 0x7f) r5 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x81f8943c, &(0x7f0000000440)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r5, 0x81f8943c, &(0x7f0000000640)={0x0, ""/256, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r5, 0xd000943d, &(0x7f0000058c40)={0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r9}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r8}], 0x1, "2156816c73038c"}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r4, 0xd000943e, &(0x7f0000000680)={r9, 0x0, "0aea58c7733d4aed580dd94b547d4a3f6402c049a693c4c3440cacb1202708a2fd4e5738b49344f9d7d7bbdf1c71b1fa4a15dd197b3d5afc5be3efd46154b681ae2ab292ff4d08eb8c537fcab74a8d63562e51799c4c7e7024d54c957233874c124f24dd4fbe4d8e50f51214dc87a0033f968d4f3edc8790faada11eacba13607b734ad2d8e626f9b2a2a66489ad7ae8aecba4095afe0f2683ff10d7e18f2a17f7fcf0e6d685b63fc803f424cd2e7c2e2fa24e19dafe57f97f07d1381135a2913d6729a50d7ffb45052c62a3b15a18c9f8f49d04ea3b3f6a8645a3f903819c7c7e567385c3a3262c837e921e18b5b510c83103e84802a5651940d41380bd6a56", "e180a90d52feabc2248e4a0c90c2777587718349ee659375600328f58d178058f38e32f01ced159420d8b880ad1e39e03a09ab0db2f1dca8025bcecf4de9aaaad23ba6466f21b9b44ccf018683ac854e4c7c45c1b9160f00e709810159d40a4b867ae9ecd0b1b0dced92a3c7d47b2315df88ae7ba6f40115d1e82b30117306b975e6f85e78a08a39a6d5f55dfa1617e48a6efcf0dbf7c2be815cb4a527fcdbc532ce4b75692bc1717b343d89fd8888ba6991bd4880ec0b225deb456a1ef183fb69c0cba559a18b057f6a57fdb302812704f158de1e715e5de64b8125022b62c52f9504738dde2dc79f12740a63a88bc76f32b5157fba824506b84a3d61215953bcdd962570a60cac8c75b7812768f4ef65ce55f94df7bb20e736a9bca5ebea5465f0e25e6ebcb369b7aa5ee435b613332865cdfd870cf83d93cb1bfc387597e9d99db4b80b441fbd74768ee093dfcaa0d0f90e4cd73388a5122c9496916e044dc28ac6331ac7ef5b546553c1665c9553f21a3fac30dc5d62fd159b45c423d25bc973cda7527eafe1324299267a26511f34b240f5ba5c8f5e9afb8b770b24c9a9e3d777e87c2e778c75ccea18fb554d55627e4dbc993e7757e3aebc8a9c4dac660a28de4b9875fe20fee58c49a9b57ed33946475c9f0643aab2397db778274c5400ea185291c117c3e793c569d4cdd06c1f2ea42bf78def05a92f3d8b025f99729ef4e8f4de83aea6133534796d0370722dba348fa4787844bec11748bf8f9299fde5c99afe79595fd1424e73b59a88ee3ea02f4ce5b360ad6d3946da638c2999f6cc8cfa81059f165648802cc469787f31db4219d24b19333d31e1e51ce66fac207a07604b82f5ac345c39245808e48cbf45d3b498ad3c505e7d5ae1d8e6b488e1250a5c9946707d3ab6954863fe040c64758080982e26b13d0011e71025d0245adbf9b0167310dc2e9b810f2491731525299831fe8c2e5f95f7ce43ed06a1d4d04b6a1d6e491b65ea86759105bf628cefb8a3853f9a8bcf082a169dbcaf6ef4b931a4c0fc2a40ea7fa79677ce8f0cd6c2fcdbf34a537f99209c39ed66af93023a6aa30d56b8fe6a39e7b83a138a1a02035b3d69e0eaa50c92599f526af0feda32f95f8e31307df7ae15becb4b41b7968b56c3e70b5dd740aa5368519f185fb8834314bd2b137b00c0e143a982ee5499cbabe10cb4034ba5cea086e14e1dbc345cc800b3bfdef8a5a8f5b3084e11d6d57a7573555707a3dce3dd19de0f425c497da1a342714c17f4fabc618f98ec19ddeeaf2291699184034956b2cebefbe8ddaa182e8cc5b8ec9b28cbe1a5c7dbc5a01e6827d1e39e182208c232127d29df359fec5db2f8eee782c4e9b934a0825994ee0ff89bf9cbab187a85cc3ab4d71b2cffbd5ff603ef7cbd11a15191c30ecea3a7fa275e1c8c89dae50b1ea29c9739f0ae3ae55822c1e0f5660ab43543b305f68187273c4cce10e119f6715488c0f1242ae2a7d6dedf0aa4f21ea24807e9c338207a55ff9475db2f302ccd37f39895b781a3a954a82320bfd470bd3c1f6f847ee6286f0b4a1a18242ffd6d45091b60f28eb4a0bf8f63aa5eda031af3e5be90eaef9157a52b3822b666c03e7398e0aad3ba441072cfb166741f3251ce7998319ae9adee89f5d2f9842d4197c41cc1850fa97ba9a39708a7da4cca827637367b19b9ec3100d7deec29cd09b1fe8b3688e61a26c97354d84b4c7f41e78a1a61b69f7a73a0f660353f46001eca921b540b3bb9f86c91e26a49e6cf10cd3039b9e47fa2803df8252aa1b9be238961b79333297fa1ab3dd12d68b776661a43330fad5f19476be3e4502076ed354ea13be487d541eca595866734fa688f877614eb4ce0dcce68e7706aae12ce08bb5ff876de7d6ac53b5229d45f5bd7c7a49bc6ff6f58b45c96f3a828bd415b0d5d23ecb272bfe98935c6c44984520be83881d0231e644dcb1e81a9356f3cb7795585e3e499c2e34f1f89d6a92fd1cc258c89b44f76352a7e2c1ccfa7f210c88783f0e6d850b5defd6b199c70d2b96670ea1ab3705b51bb8b875ea7e2ad767bd2acd094f46bd7e1ba9ff1decf83951f8011ff0f610b035c8e7b207af7b52e2a9820f7cd76aa33401eb5124278293a0361ae627e3432faeadc8ad523666e933c81de8b2b21968e98d00c02b111c5c985a0c9503d7d345191a6728edbe950717aa979986c13444d4b77fa64d2ccd3e45fa66aef24957975e53a889e613180ae7f35c93c4e2f174b9e3bc46bd6ec28c0b4209a7e6dc71a8578912358deb2af4466f669403300ef1e9299b4b8b5881e234c0f42a0d6f1a8f44611c68294d42b9e487d3cc042c1474847f5a1fd61b4d9625a59c25d6ea71dba3d394eb4feb2d960fd995c80224a06f8d8d3d2d43ff066c68085c4a2606a5737dd4d08b634b49402b6d3b6f4361462ea065c4b17c25140877995c5918f24de5a69395fcb2a0186ea565df4aae0ba35c6476c004bd2e06cd5607b67998fff1194e12fa8abe53cfc567b9a25ca240443dc75947f21ddcb40ba5dbef816c2a63b507bcad0e3e19e3b92d2369e5486c5634f775a19c6672736cfb3613394f922b2bfc0ec6d5b991112d303293985442fd0326e51cc6a09ab184fbf4d6503f533afbacbdb34ea9677a5e7e43d815112a1f0992723cef585476a25ab81399d4fe05f0965fe7d9909d5fe0b599ab07e855ec7eae0eba74ce9c8ce932dcff451ab8ea22317afdc126710c7a86a16b9bad44d258880788c78885d0db127a235237f91a2bb546fc77bfdfd31c1d3dda9b055d32941c01313cdffb907a0eaee5586185478b0b524def54c318df801cf1aa97628e7c2a989c2367559d3520fe3e6a8f957ef60447388cff2c4f1345ce46c4d72e0b4f0914c49441bb8f563c765b5d93a7f55ff67fcf327048a41bb8d098f8c0a2e7e1d0a1bbcafb365335a13e436aeb692c8c0ddf37b94be1d556068d358010ba455f3de76feb0d3c24b1535b28bb7b9762abb0ef826efd0773e54d19ed990248cc1478ad7dee6fc5b412a88ad8ebfce47f2824099b1aadfd5b8e4ce2419a5b0942daa805f625065dcba5eb2c38ad413fed4ac24688a087e6a774ec8f70c4280c3d9405fdc1bb3fe90d17bc805952782efd29d19a3d06b2b38a174a790e268236faf355409277c041b217dd1167e7fa2fdc770528795a8a12a574f1d27ae97485f9dbfa557213fa92694e852c32d895194e324fbf83dc1e84eb9d1eb6c6309f2004fc8341748c8c0588a71ba2186cdb8ca17913e9a027df9b0bbac367e5aebed9c695b5bb314b5784512ba51539b1eb0e989e8566ae6e6b1394f89b7078e1668ec590f2ddd3e4d742af2b6dccf6de7001d3836228621e4ecd018c6b05a7cb0bbfd539f508e1a03ba11319c13c9b59b375fdc3d125bbbc08438ee14612602148432966add5a6019d115a56b4502b913c86254ee96eebafb6178b0be87eb49ce04e33042fdf0d393b496ba379b2dfa02752f7da51c94c6b12ba477b5b94a56a8c87289f9c0e89956b2965e4cf6e12e324982791534d2a2315202277a18819403de69e8a85cf9d37f7170be841f11785a25eb83b46e826a894f71cfffff0b7e01d6761c639d8771c61ef600e173218fe39a95bba437fb9245c5f21a5e4f63d2dba0e20bd8a4516701360050a59a8c05723f664c1f8039a861e7063d13896cfc124797ab337119a05c3f848c5f6c9eb0876d584c9d83b5ad3012655f4f9a481ce0c8b50dca836ccb3d9de133e02c6533b72f11fdbb9c43b51e8efbcdbfa5a255c0cab67ce758ce0b6e25b79201f897d5b9a74cf2745d58ee1e3627760d3f9e04c4b71d553265959e8ebead8ee57013a303452f9e3f3b23e0a40af2ea8bd674be1f8e3777077cfa7ac20d6ccfff63470925efbaf5ca937293792b6a7b2d710f86dec7762dfa749622080d0c60d93ea256a701b2150c11e70251e9e8be867b2b54f91dff2be3908a35691920ec9804943301f1a91435076ef29dfec06ba7725589b2524acb10ad5f789660e670eb75cde374d967535d5f39fa092b8e506ecd49244dd2dc25f277a27952877bef90d7b6f54ea62abca72caeda89abf95577cbd0a7a388bd2080b5cb7e6e899cd719702115d5aadf464c6585eac4ee588e6a5e87502154996d596eb1f82e63a0b61e1241c106a9539ed3513fb5bca875414a0987ad3da5015c1f529ba6634828de52ddac8605e1f05478b8877a8b5ed7743e40ecc35f0198ceefcd56279ab53c8efd548b10f67e6b74896338bbfffafb803026665c8e578625d224f48b658fd1d6c1302a234e401b65c3e82f928480becbe8c587715b8b32f413fde47bb6e7a3205ab4762eca289aa54777573b610d91d6a6e35a3cfb747aa3d51ea1c4a5345c0c6188a088d235cc60ffe25090ca998760896d0ad1c1dec10faf5732b96b7ae9126f8045a44a3855919474e12bc8c3577aee9b56b8cbc5c28e5a2f9e74f880abdac8995bb342394361587c47104360a3fb277c42fdb6b7b6b8eb9ecd8721c53ffe28f663f99087a1b9ed931712e034a1b4408a0e53089e55870fedf29bf54134d5aee9ba0f1b95f29edfd500ccb8c9a778799bfa8d4ebaefbbd8e483c5176d91b7a1a474a4f371fe536b328374b69682fb34a0aa4bdaacfb53cc586ea6e0b78dfd79c7fb2004da49fa822a1312c28c05df155f34efda6c954dca5987bd50310ea43bfb698ab68a2a723036de8886a8d22ff6ce7395bc019fa22242f21948cedc9039eeec802bb669453747b11af00faf8a7e700f7e4f4963c6d59604589ed7fa619f2cc4b1d374f4ce21975984a25439708e9bd43fc1496439221eaa4a45e9b0ef7e82ce57aa75d9f896c8223c73b9eb534c1e220e068d04530fb8f4de712ad08f70f560b7d61d0a14172598d6b3af15adcb721ab1cc6dad9330900c6a9a5b23318cf77f5df9335bfdb3bec77c46ee97aca17e915d97d9b67253ab536e5555a1c1e89bb1cf382e013b205dce48b36ffbfb1628f595f88dde58c11d2bb1d8574da10d7661b0f42e4bcfa40b0d2b4e56f8d807017539c60537694d1ed1775beb6b58bcc2e53ad1cbc10e0652d3121b27a64de428bfc88c4e591940865e783ec237d08381de6913287629055afdf214434f0db7a04b7bd7b2db3b6a2bd316a9c1e670baa9935ebe6baf27ae042988d95da2e227269d1f3d066907cc05120f6c4674932504c99e675cefabb1795a0b58d7bf57d2d9bfcacb2518ae16378dc770d0c54cdceda7f544d2ed04366049bf77f98a5afc7bc62195982dba6b4ade03519dc2852d111764ea22ff420712bbd52df1d611cde3b04b22bcc1b52c5133c0fcf1c96045fc32d396db3a0fef9bbb97cff951c83d2a986787eee6ecd9ede5ef0df26e24f17a22851c9946cceb"}) [ 2086.653752][ C1] sd 0:0:1:0: tag#1585 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2086.663856][ C1] sd 0:0:1:0: tag#1585 CDB: opcode=0xe5 (vendor) [ 2086.670291][ C1] sd 0:0:1:0: tag#1585 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2086.679439][ C1] sd 0:0:1:0: tag#1585 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2086.688492][ C1] sd 0:0:1:0: tag#1585 CDB[20]: ba 17:22:24 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3500, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2086.700349][T31855] loop5: detected capacity change from 0 to 4 [ 2086.711446][T31855] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:24 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) ioctl$SG_GET_NUM_WAITING(0xffffffffffffffff, 0x227d, &(0x7f0000000040)) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:24 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800005000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:24 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x7}]) [ 2086.788731][T31898] loop0: detected capacity change from 0 to 512 17:22:24 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x18e0, 0x2, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2086.835175][T31909] loop5: detected capacity change from 0 to 4 [ 2086.851428][T31898] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:24 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2086.889980][T31909] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:24 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x1f8}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) r3 = syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) r6 = socket$inet6(0xa, 0x401000000001, 0x0) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r6, r7, 0x0, 0x800100000001) syz_io_uring_submit(r4, r2, &(0x7f0000000240)=@IORING_OP_EPOLL_CTL=@del={0x1d, 0x4, 0x0, r7, 0x0, r3}, 0x1) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(r1, r5, &(0x7f00000000c0)=@IORING_OP_WRITE={0x17, 0x4, 0x6004, @fd=r0, 0x2, &(0x7f0000000040)="dcd0a5ca416a88a4b7e1678bec9185870b552a5cb63932b7b861388263ed26a16a6d32db1cda923744600e7e56652db9639fc39692e2f28d3de11369f9bff8dafddac9d837f13342d8dd5b6956bbf9786e116aff9c81f2c75649905fbe32358146c3c7682a10a07720284f", 0x6b}, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2086.954715][T31909] loop5: detected capacity change from 0 to 4 [ 2086.964826][T31909] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:24 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x350b, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:24 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3600, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2086.998108][T31940] loop0: detected capacity change from 0 to 512 [ 2087.007690][T31940] EXT4-fs (loop0): bad geometry: block count 33554560 exceeds size of device (128 blocks) 17:22:24 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000080)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x6, 0x0, 0x7df, 0x0, &(0x7f0000000040)="76468f58d362c91d4bb012f6e7416a73482f383f8a6fc1f857f789b8cbced5fac25cdf6694349052024cb7", 0x8001, 0x0, 0x1, {0x3}}, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) ppoll(0x0, 0x0, &(0x7f0000000200)={r3, r4+60000000}, &(0x7f0000000440)={[0xfffffffffffffffd]}, 0x8) 17:22:24 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001803105000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:24 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x8}]) [ 2087.048700][T31940] loop0: detected capacity change from 0 to 512 [ 2087.077242][T31940] EXT4-fs (loop0): bad geometry: block count 33554560 exceeds size of device (128 blocks) 17:22:24 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2087.109762][T31963] loop5: detected capacity change from 0 to 4 [ 2087.135145][T31963] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:24 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3600, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2087.172982][T31973] loop0: detected capacity change from 0 to 512 [ 2087.189476][T31973] EXT4-fs (loop0): bad geometry: block count 50331776 exceeds size of device (128 blocks) 17:22:24 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x9}]) [ 2087.235076][T31963] loop5: detected capacity change from 0 to 4 [ 2087.242731][T31973] loop0: detected capacity change from 0 to 512 [ 2087.250363][T31963] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2087.264033][T31973] EXT4-fs (loop0): bad geometry: block count 50331776 exceeds size of device (128 blocks) 17:22:24 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800006000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:24 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3700, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:24 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3700, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:24 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2087.360534][T31999] loop5: detected capacity change from 0 to 4 [ 2087.377088][T31999] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:25 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800406000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2087.406908][T32012] loop0: detected capacity change from 0 to 512 17:22:25 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3800, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2087.450068][T32012] EXT4-fs (loop0): bad geometry: block count 67108992 exceeds size of device (128 blocks) [ 2087.471292][T32021] loop5: detected capacity change from 0 to 4 [ 2087.491136][T32021] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2087.550919][T32021] loop5: detected capacity change from 0 to 4 [ 2087.572851][T32021] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:25 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000506000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:25 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xa}]) 17:22:25 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x400}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) 17:22:25 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3900, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:25 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3800, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:25 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800007000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2087.970709][T32050] loop5: detected capacity change from 0 to 4 [ 2087.975386][T32055] loop0: detected capacity change from 0 to 512 [ 2087.983260][T32050] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:25 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3500, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:25 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800009000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2088.011762][T32055] EXT4-fs (loop0): bad geometry: block count 83886208 exceeds size of device (128 blocks) 17:22:25 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3a00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2088.078933][T32075] loop5: detected capacity change from 0 to 4 [ 2088.105749][T32055] loop0: detected capacity change from 0 to 512 17:22:25 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xb}]) [ 2088.124343][T32055] EXT4-fs (loop0): bad geometry: block count 83886208 exceeds size of device (128 blocks) [ 2088.136943][T32075] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:25 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000606000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2088.199117][T32075] loop5: detected capacity change from 0 to 4 [ 2088.226985][T32075] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:25 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000a000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2088.243707][T32099] loop0: detected capacity change from 0 to 512 17:22:25 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3b00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:25 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) io_uring_register$IORING_UNREGISTER_BUFFERS(r0, 0x1, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = mmap$IORING_OFF_SQ_RING(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000004, 0x30, r3, 0x0) syz_io_uring_submit(r4, r2, &(0x7f00000001c0)=@IORING_OP_FSYNC={0x3, 0x3, 0x0, @fd=r0}, 0x1e4) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) r5 = socket$inet6(0xa, 0x401000000001, 0x0) close(r5) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_FSYNC={0x3, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x1}, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r3, 0xc08c5336, &(0x7f0000000240)={0x3, 0x7ff, 0x0, 'queue1\x00', 0xffff}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0xe, 0x110, r3, 0xe17aa000) r6 = accept4$inet(r3, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000000c0)=0x10, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x81f8943c, &(0x7f0000000680)) r7 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x800100000001) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000040)={0x4, 0x6, 0xa28, 0xfd62, 0x400}) [ 2088.317398][T32099] EXT4-fs (loop0): bad geometry: block count 100663424 exceeds size of device (128 blocks) [ 2088.321619][T32110] loop5: detected capacity change from 0 to 4 17:22:25 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3900, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2088.358569][T32110] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2088.384269][T32099] loop0: detected capacity change from 0 to 512 [ 2088.398736][T32099] EXT4-fs (loop0): bad geometry: block count 100663424 exceeds size of device (128 blocks) 17:22:26 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:26 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000706000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:26 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xc}]) [ 2088.410171][T32110] loop5: detected capacity change from 0 to 4 [ 2088.446670][T32110] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:26 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000b000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2088.507226][T32146] loop0: detected capacity change from 0 to 512 [ 2088.541546][T32146] EXT4-fs (loop0): bad geometry: block count 117440640 exceeds size of device (128 blocks) [ 2088.550967][T32152] loop5: detected capacity change from 0 to 4 17:22:26 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3c00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2088.591461][T32152] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2088.618168][T32146] loop0: detected capacity change from 0 to 512 [ 2088.638304][T32152] loop5: detected capacity change from 0 to 4 [ 2088.640403][T32146] EXT4-fs (loop0): bad geometry: block count 117440640 exceeds size of device (128 blocks) [ 2088.655018][T32152] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:26 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xd}]) 17:22:26 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000c000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:26 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3d00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:26 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:26 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:26 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3a00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2088.777570][T32187] loop5: detected capacity change from 0 to 4 [ 2088.802966][T32187] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2088.824245][T32194] loop0: detected capacity change from 0 to 512 17:22:26 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000d000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:26 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3e00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:26 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xe}]) [ 2088.848397][T32194] EXT4-fs (loop0): bad geometry: block count 134217856 exceeds size of device (128 blocks) [ 2088.867117][T32187] loop5: detected capacity change from 0 to 4 [ 2088.878790][T32187] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2088.938976][T32194] loop0: detected capacity change from 0 to 512 [ 2088.944273][T32222] loop5: detected capacity change from 0 to 4 [ 2088.961866][T32194] EXT4-fs (loop0): bad geometry: block count 134217856 exceeds size of device (128 blocks) [ 2088.990085][T32222] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:26 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000906000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:26 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x3f00, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:26 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3b00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:26 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xf}]) [ 2089.071279][T32222] loop5: detected capacity change from 0 to 4 [ 2089.075538][T32238] loop0: detected capacity change from 0 to 512 [ 2089.096903][T32222] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2089.108661][T32238] EXT4-fs (loop0): bad geometry: block count 150995072 exceeds size of device (128 blocks) 17:22:26 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000e000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2089.167838][T32238] loop0: detected capacity change from 0 to 512 [ 2089.177815][T32238] EXT4-fs (loop0): bad geometry: block count 150995072 exceeds size of device (128 blocks) [ 2089.208078][T32259] loop5: detected capacity change from 0 to 4 17:22:26 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000a06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2089.250129][T32259] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:26 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x4000, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:26 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140), &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x401000000001, 0x0) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r3, r4, 0x0, 0x800100000001) io_uring_enter(r4, 0x5448, 0x28ab, 0x0, &(0x7f0000000040)={[0xff]}, 0x8) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) [ 2089.308670][T32270] loop0: detected capacity change from 0 to 512 [ 2089.337226][T32270] EXT4-fs (loop0): bad geometry: block count 167772288 exceeds size of device (128 blocks) 17:22:26 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x10}]) [ 2089.371093][T32259] loop5: detected capacity change from 0 to 4 [ 2089.389938][T32270] loop0: detected capacity change from 0 to 512 [ 2089.392611][T32259] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2089.406728][T32270] EXT4-fs (loop0): bad geometry: block count 167772288 exceeds size of device (128 blocks) 17:22:27 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xff0f, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:27 executing program 4: r0 = syz_io_uring_setup(0x17e6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x4}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000400)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd=r0, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x20a7, 0x0, 0x0, 0x0, 0x0) close(0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000440), 0x8) syz_io_uring_submit(0x0, r2, &(0x7f0000000040)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x8001) 17:22:27 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800011000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:27 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000b06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:27 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3c00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:27 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xa00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2089.520883][T32314] loop5: detected capacity change from 0 to 4 [ 2089.534814][T32315] loop0: detected capacity change from 0 to 512 [ 2089.558506][T32315] EXT4-fs (loop0): bad geometry: block count 184549504 exceeds size of device (128 blocks) 17:22:27 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x11}]) [ 2089.582807][T32314] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2089.598363][T32315] loop0: detected capacity change from 0 to 512 [ 2089.618351][T32315] EXT4-fs (loop0): bad geometry: block count 184549504 exceeds size of device (128 blocks) 17:22:27 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800012000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:27 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xff7f, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2089.642213][T32314] loop5: detected capacity change from 0 to 4 [ 2089.653426][T32314] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:27 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000c06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2089.741655][T32350] loop5: detected capacity change from 0 to 4 [ 2089.749551][T32354] loop0: detected capacity change from 0 to 512 [ 2089.761130][T32350] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2089.790812][T32354] EXT4-fs (loop0): bad geometry: block count 201326720 exceeds size of device (128 blocks) 17:22:27 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x12}]) 17:22:27 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0xffff, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:27 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3d00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2089.838643][T32350] loop5: detected capacity change from 0 to 4 [ 2089.848454][T32354] loop0: detected capacity change from 0 to 512 [ 2089.873711][T32350] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:27 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800018000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2089.896174][T32354] EXT4-fs (loop0): bad geometry: block count 201326720 exceeds size of device (128 blocks) 17:22:27 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000d06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2089.984890][T32386] loop5: detected capacity change from 0 to 4 [ 2090.007123][T32386] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:27 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x29, 0x0, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:27 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x13}]) [ 2090.045483][T32393] loop0: detected capacity change from 0 to 512 [ 2090.060078][T32393] EXT4-fs (loop0): bad geometry: block count 218103936 exceeds size of device (128 blocks) 17:22:27 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:27 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000e06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2090.094035][T32386] loop5: detected capacity change from 0 to 4 [ 2090.110503][T32386] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:27 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180001c000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2090.165293][T32416] loop0: detected capacity change from 0 to 512 [ 2090.201161][T32416] EXT4-fs (loop0): bad geometry: block count 234881152 exceeds size of device (128 blocks) 17:22:27 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x14}]) [ 2090.272857][T32425] loop5: detected capacity change from 0 to 4 [ 2090.277097][T32416] loop0: detected capacity change from 0 to 512 [ 2090.289795][T32416] EXT4-fs (loop0): bad geometry: block count 234881152 exceeds size of device (128 blocks) 17:22:27 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x700, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:27 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3e00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:27 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000f06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2090.318211][T32425] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2090.397057][T32425] loop5: detected capacity change from 0 to 4 [ 2090.403952][T32425] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2090.454371][ C1] scsi_io_completion_action: 32 callbacks suppressed [ 2090.454421][ C1] sd 0:0:1:0: tag#1559 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2090.459134][T32454] loop0: detected capacity change from 0 to 512 [ 2090.461186][ C1] sd 0:0:1:0: tag#1559 CDB: opcode=0xe5 (vendor) [ 2090.483594][ C1] sd 0:0:1:0: tag#1559 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2090.492638][ C1] sd 0:0:1:0: tag#1559 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 17:22:28 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x3, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2090.501665][ C1] sd 0:0:1:0: tag#1559 CDB[20]: ba [ 2090.525632][T32454] EXT4-fs (loop0): bad geometry: block count 251658368 exceeds size of device (128 blocks) [ 2090.544373][ C0] sd 0:0:1:0: tag#1560 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2090.554232][ C0] sd 0:0:1:0: tag#1560 CDB: opcode=0xe5 (vendor) [ 2090.560604][ C0] sd 0:0:1:0: tag#1560 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2090.569654][ C0] sd 0:0:1:0: tag#1560 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2090.578714][ C0] sd 0:0:1:0: tag#1560 CDB[20]: ba [ 2090.601878][ C1] sd 0:0:1:0: tag#1561 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2090.611722][ C1] sd 0:0:1:0: tag#1561 CDB: opcode=0xe5 (vendor) [ 2090.618067][ C1] sd 0:0:1:0: tag#1561 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2090.627112][ C1] sd 0:0:1:0: tag#1561 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2090.636183][ C1] sd 0:0:1:0: tag#1561 CDB[20]: ba 17:22:28 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800020000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:28 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x15}]) [ 2090.704612][T32454] loop0: detected capacity change from 0 to 512 [ 2090.728774][T32454] EXT4-fs (loop0): bad geometry: block count 251658368 exceeds size of device (128 blocks) 17:22:28 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2090.749422][T32474] loop5: detected capacity change from 0 to 4 [ 2090.774664][T32474] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:28 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x4, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:28 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3f00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:28 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800025000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2090.839093][T32474] loop5: detected capacity change from 0 to 4 [ 2090.849275][T32474] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2090.851081][T32484] loop0: detected capacity change from 0 to 512 17:22:28 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x16}]) 17:22:28 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x700, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2090.915182][T32500] loop5: detected capacity change from 0 to 4 [ 2090.934646][T32484] EXT4-fs (loop0): bad geometry: block count 268435584 exceeds size of device (128 blocks) [ 2090.947029][T32500] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2090.992231][ C1] sd 0:0:1:0: tag#1549 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2091.002100][ C1] sd 0:0:1:0: tag#1549 CDB: opcode=0xe5 (vendor) [ 2091.008466][ C1] sd 0:0:1:0: tag#1549 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2091.017508][ C1] sd 0:0:1:0: tag#1549 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2091.026636][ C1] sd 0:0:1:0: tag#1549 CDB[20]: ba [ 2091.027441][ C0] sd 0:0:1:0: tag#1550 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 17:22:28 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800026000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2091.041599][ C0] sd 0:0:1:0: tag#1550 CDB: opcode=0xe5 (vendor) [ 2091.047952][ C0] sd 0:0:1:0: tag#1550 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2091.057014][ C0] sd 0:0:1:0: tag#1550 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2091.066054][ C0] sd 0:0:1:0: tag#1550 CDB[20]: ba 17:22:28 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x5, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:28 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x17}]) [ 2091.166773][T32516] loop5: detected capacity change from 0 to 4 [ 2091.180094][T32484] loop0: detected capacity change from 0 to 512 [ 2091.193738][T32516] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2091.216100][T32484] EXT4-fs (loop0): bad geometry: block count 268435584 exceeds size of device (128 blocks) [ 2091.237865][T32516] loop5: detected capacity change from 0 to 4 [ 2091.254718][T32516] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:28 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001106000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:28 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x4000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2091.269146][ C1] sd 0:0:1:0: tag#1556 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2091.279005][ C1] sd 0:0:1:0: tag#1556 CDB: opcode=0xe5 (vendor) [ 2091.285331][ C1] sd 0:0:1:0: tag#1556 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2091.294388][ C1] sd 0:0:1:0: tag#1556 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2091.303433][ C1] sd 0:0:1:0: tag#1556 CDB[20]: ba [ 2091.338150][ C0] sd 0:0:1:0: tag#1560 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2091.348043][ C0] sd 0:0:1:0: tag#1560 CDB: opcode=0xe5 (vendor) [ 2091.354378][ C0] sd 0:0:1:0: tag#1560 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2091.363437][ C0] sd 0:0:1:0: tag#1560 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2091.372504][ C0] sd 0:0:1:0: tag#1560 CDB[20]: ba [ 2091.400582][T32542] loop0: detected capacity change from 0 to 512 [ 2091.433196][ C1] sd 0:0:1:0: tag#1596 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2091.443071][ C1] sd 0:0:1:0: tag#1596 CDB: opcode=0xe5 (vendor) 17:22:29 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800531000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2091.449411][ C1] sd 0:0:1:0: tag#1596 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2091.458463][ C1] sd 0:0:1:0: tag#1596 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2091.467491][ C1] sd 0:0:1:0: tag#1596 CDB[20]: ba [ 2091.481845][T32542] EXT4-fs (loop0): bad geometry: block count 285212800 exceeds size of device (128 blocks) 17:22:29 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x21}]) [ 2091.533635][T32554] loop5: detected capacity change from 0 to 4 [ 2091.560230][T32542] loop0: detected capacity change from 0 to 512 [ 2091.567916][T32554] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:29 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x6, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2091.579739][T32542] EXT4-fs (loop0): bad geometry: block count 285212800 exceeds size of device (128 blocks) 17:22:29 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2091.664607][T32554] loop5: detected capacity change from 0 to 4 [ 2091.691027][T32554] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:29 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180003f000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:29 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xff0f, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2091.710686][ C0] sd 0:0:1:0: tag#1557 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2091.720540][ C0] sd 0:0:1:0: tag#1557 CDB: opcode=0xe5 (vendor) [ 2091.726892][ C0] sd 0:0:1:0: tag#1557 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2091.735952][ C0] sd 0:0:1:0: tag#1557 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2091.744973][ C0] sd 0:0:1:0: tag#1557 CDB[20]: ba 17:22:29 executing program 4: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001106000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:29 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x22}]) [ 2091.791431][T32583] loop0: detected capacity change from 0 to 512 [ 2091.826112][T32583] EXT4-fs (loop0): bad geometry: block count 301990016 exceeds size of device (128 blocks) [ 2091.876247][T32596] loop5: detected capacity change from 0 to 4 [ 2091.889888][ C1] sd 0:0:1:0: tag#1572 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2091.899735][ C1] sd 0:0:1:0: tag#1572 CDB: opcode=0xe5 (vendor) [ 2091.906086][ C1] sd 0:0:1:0: tag#1572 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2091.909503][T32596] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:29 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3f00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:29 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x7, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2091.915184][ C1] sd 0:0:1:0: tag#1572 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2091.930897][ C1] sd 0:0:1:0: tag#1572 CDB[20]: ba [ 2092.019312][T32583] loop0: detected capacity change from 0 to 512 [ 2092.029731][T32596] loop5: detected capacity change from 0 to 4 [ 2092.040853][T32596] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2092.048449][T32583] EXT4-fs (loop0): bad geometry: block count 301990016 exceeds size of device (128 blocks) 17:22:29 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xff7f, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:29 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800040000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:29 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2092.159194][T32628] loop5: detected capacity change from 0 to 4 [ 2092.177726][T32631] loop0: detected capacity change from 0 to 512 [ 2092.186276][T32628] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:29 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x204}]) [ 2092.215910][T32631] EXT4-fs (loop0): bad geometry: block count 402653312 exceeds size of device (128 blocks) 17:22:29 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x8, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2092.259163][T32628] loop5: detected capacity change from 0 to 4 [ 2092.274446][T32628] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2092.316546][T32631] loop0: detected capacity change from 0 to 512 [ 2092.331843][T32631] EXT4-fs (loop0): bad geometry: block count 402653312 exceeds size of device (128 blocks) 17:22:30 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800048000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:30 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000001a06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2092.411310][T32659] loop5: detected capacity change from 0 to 4 17:22:30 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x300}]) 17:22:30 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x80000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2092.453562][T32659] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2092.472625][T32668] loop0: detected capacity change from 0 to 512 [ 2092.505317][T32668] EXT4-fs (loop0): bad geometry: block count 436207744 exceeds size of device (128 blocks) [ 2092.517272][T32659] loop5: detected capacity change from 0 to 4 [ 2092.525335][T32659] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:30 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180004c000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:30 executing program 4: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x16}]) 17:22:30 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x9, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2092.599754][T32668] loop0: detected capacity change from 0 to 512 [ 2092.613725][T32668] EXT4-fs (loop0): bad geometry: block count 436207744 exceeds size of device (128 blocks) [ 2092.639290][T32694] loop5: detected capacity change from 0 to 4 17:22:30 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000002206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:30 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x402}]) [ 2092.681125][T32694] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2092.743080][T32707] loop0: detected capacity change from 0 to 512 [ 2092.752416][T32694] loop5: detected capacity change from 0 to 4 [ 2092.773600][T32694] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2092.780890][T32707] EXT4-fs (loop0): bad geometry: block count 570425472 exceeds size of device (128 blocks) 17:22:30 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800068000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:30 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xa, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:30 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x406}]) 17:22:30 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x800000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:30 executing program 4: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x402}]) [ 2092.880822][T32707] loop0: detected capacity change from 0 to 512 [ 2092.880822][T32725] loop5: detected capacity change from 0 to 4 [ 2092.894008][T32707] EXT4-fs (loop0): bad geometry: block count 570425472 exceeds size of device (128 blocks) [ 2092.910727][T32725] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:30 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000002506000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2092.979132][T32725] loop5: detected capacity change from 0 to 4 [ 2092.990122][T32725] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2092.998448][T32751] loop0: detected capacity change from 0 to 512 17:22:30 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180006c000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2093.039055][T32751] EXT4-fs (loop0): bad geometry: block count 620757120 exceeds size of device (128 blocks) [ 2093.092994][T32764] loop5: detected capacity change from 0 to 4 [ 2093.112344][T32764] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:30 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x500}]) 17:22:30 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xf0ff00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:30 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 1) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) [ 2093.143745][T32751] loop0: detected capacity change from 0 to 512 [ 2093.159480][T32764] loop5: detected capacity change from 0 to 4 [ 2093.177698][T32764] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2093.184650][T32751] EXT4-fs (loop0): bad geometry: block count 620757120 exceeds size of device (128 blocks) [ 2093.219367][ T319] FAULT_INJECTION: forcing a failure. [ 2093.219367][ T319] name failslab, interval 1, probability 0, space 0, times 0 [ 2093.232013][ T319] CPU: 0 PID: 319 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2093.242024][ T319] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2093.252080][ T319] Call Trace: [ 2093.255355][ T319] dump_stack_lvl+0xd6/0x122 [ 2093.259956][ T319] dump_stack+0x11/0x1b [ 2093.264120][ T319] should_fail+0x23c/0x250 [ 2093.268622][ T319] ? kmalloc_array+0x2d/0x40 [ 2093.273255][ T319] __should_failslab+0x81/0x90 [ 2093.278047][ T319] should_failslab+0x5/0x20 [ 2093.282555][ T319] __kmalloc+0x6f/0x350 [ 2093.286777][ T319] kmalloc_array+0x2d/0x40 [ 2093.291210][ T319] iter_file_splice_write+0xd5/0x790 [ 2093.296499][ T319] ? avc_policy_seqno+0x22/0x30 [ 2093.301348][ T319] ? selinux_file_permission+0x223/0x350 [ 2093.307091][ T319] ? fsnotify_perm+0x5a/0x370 [ 2093.311805][ T319] ? security_file_permission+0x7c/0xa0 [ 2093.317565][ T319] ? splice_from_pipe+0xd0/0xd0 [ 2093.322425][ T319] do_splice+0x9ca/0xd50 [ 2093.326753][ T319] ? proc_fail_nth_write+0x127/0x150 [ 2093.332203][ T319] ? vfs_write+0x61a/0x900 [ 2093.336628][ T319] ? __fget_light+0x21b/0x260 [ 2093.341386][ T319] __se_sys_splice+0x2bd/0x3a0 [ 2093.346158][ T319] __x64_sys_splice+0x74/0x80 [ 2093.350847][ T319] do_syscall_64+0x44/0xa0 [ 2093.355269][ T319] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2093.361168][ T319] RIP: 0033:0x7f704a8e28d9 [ 2093.365616][ T319] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2093.385353][ T319] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2093.393770][ T319] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2093.401747][ T319] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2093.409899][ T319] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 17:22:30 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xb, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:31 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000002e06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2093.417872][ T319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2093.425845][ T319] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 17:22:31 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800074000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:31 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x600}]) [ 2093.495853][ T331] loop0: detected capacity change from 0 to 512 [ 2093.513356][ T331] EXT4-fs (loop0): bad geometry: block count 771752064 exceeds size of device (128 blocks) 17:22:31 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xc, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2093.550385][ T337] loop5: detected capacity change from 0 to 4 [ 2093.564801][ T337] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2093.571713][ T331] loop0: detected capacity change from 0 to 512 [ 2093.589960][ T331] EXT4-fs (loop0): bad geometry: block count 771752064 exceeds size of device (128 blocks) 17:22:31 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000003206000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:31 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xfff000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2093.640795][ T337] loop5: detected capacity change from 0 to 4 [ 2093.664870][ T337] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:31 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180007a000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2093.699309][ T362] loop0: detected capacity change from 0 to 512 [ 2093.710213][ T362] EXT4-fs (loop0): bad geometry: block count 838860928 exceeds size of device (128 blocks) [ 2093.764198][ T373] loop5: detected capacity change from 0 to 4 [ 2093.786938][ T362] loop0: detected capacity change from 0 to 512 [ 2093.789753][ T373] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:31 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x604}]) [ 2093.807247][ T362] EXT4-fs (loop0): bad geometry: block count 838860928 exceeds size of device (128 blocks) 17:22:31 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000003506000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2093.871030][ T373] loop5: detected capacity change from 0 to 4 [ 2093.883175][ T394] loop0: detected capacity change from 0 to 512 [ 2093.891596][ T373] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2093.899972][ T394] EXT4-fs (loop0): bad geometry: block count 889192576 exceeds size of device (128 blocks) 17:22:31 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800480000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2093.940021][ T394] loop0: detected capacity change from 0 to 512 [ 2093.957760][ T394] EXT4-fs (loop0): bad geometry: block count 889192576 exceeds size of device (128 blocks) [ 2093.983874][ T410] loop5: detected capacity change from 0 to 4 [ 2093.995977][ T410] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:31 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 2) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:31 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:31 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xd, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:31 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004306000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:31 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x700}]) [ 2094.052551][ T410] loop5: detected capacity change from 0 to 4 [ 2094.084543][ T410] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2094.100356][ T428] loop0: detected capacity change from 0 to 512 [ 2094.133482][ T428] EXT4-fs (loop0): bad geometry: block count 1124073600 exceeds size of device (128 blocks) [ 2094.167014][ T426] FAULT_INJECTION: forcing a failure. [ 2094.167014][ T426] name failslab, interval 1, probability 0, space 0, times 0 [ 2094.179642][ T426] CPU: 1 PID: 426 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2094.189658][ T426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2094.199726][ T426] Call Trace: [ 2094.202997][ T426] dump_stack_lvl+0xd6/0x122 [ 2094.207595][ T426] dump_stack+0x11/0x1b [ 2094.211741][ T426] should_fail+0x23c/0x250 [ 2094.216149][ T426] __should_failslab+0x81/0x90 [ 2094.220910][ T426] ? __iomap_dio_rw+0x139/0x1010 [ 2094.225850][ T426] should_failslab+0x5/0x20 [ 2094.230346][ T426] kmem_cache_alloc_trace+0x52/0x320 [ 2094.235617][ T426] __iomap_dio_rw+0x139/0x1010 [ 2094.240380][ T426] ? put_dec_trunc8+0x10e/0x130 [ 2094.245233][ T426] ? ext4_xattr_security_get+0x2e/0x40 [ 2094.250691][ T426] ? ext4_initxattrs+0xb0/0xb0 [ 2094.255448][ T426] ? __vfs_getxattr+0x264/0x280 [ 2094.260310][ T426] iomap_dio_rw+0x30/0x70 [ 2094.264720][ T426] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2094.270248][ T426] ext4_file_write_iter+0xaa9/0x11f0 [ 2094.275533][ T426] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2094.281044][ T426] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2094.286911][ T426] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2094.292268][ T426] ? __list_del_entry_valid+0x54/0xc0 [ 2094.297621][ T426] do_iter_readv_writev+0x2de/0x380 [ 2094.302830][ T426] do_iter_write+0x192/0x5c0 [ 2094.307450][ T426] ? splice_from_pipe_next+0x34f/0x3b0 [ 2094.312973][ T426] ? kmalloc_array+0x2d/0x40 [ 2094.317568][ T426] vfs_iter_write+0x4c/0x70 [ 2094.322066][ T426] iter_file_splice_write+0x43a/0x790 [ 2094.327437][ T426] ? splice_from_pipe+0xd0/0xd0 17:22:31 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fffe000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2094.332281][ T426] do_splice+0x9ca/0xd50 [ 2094.336540][ T426] ? proc_fail_nth_write+0x127/0x150 [ 2094.341881][ T426] ? vfs_write+0x61a/0x900 [ 2094.346303][ T426] ? __fget_light+0x21b/0x260 [ 2094.351057][ T426] __se_sys_splice+0x2bd/0x3a0 [ 2094.355813][ T426] __x64_sys_splice+0x74/0x80 [ 2094.360486][ T426] do_syscall_64+0x44/0xa0 [ 2094.364908][ T426] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2094.370804][ T426] RIP: 0033:0x7f704a8e28d9 17:22:32 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xe, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2094.375243][ T426] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2094.394852][ T426] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2094.403255][ T426] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2094.411220][ T426] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2094.419188][ T426] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2094.427245][ T426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2094.435212][ T426] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2094.449399][ T449] loop5: detected capacity change from 0 to 4 17:22:32 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:32 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180feff000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2094.475455][ T449] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2094.484375][ T428] loop0: detected capacity change from 0 to 512 [ 2094.494563][ T428] EXT4-fs (loop0): bad geometry: block count 1124073600 exceeds size of device (128 blocks) 17:22:32 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2094.534629][ T464] loop5: detected capacity change from 0 to 4 [ 2094.551310][ T464] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:32 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x900}]) [ 2094.601482][ T473] loop0: detected capacity change from 0 to 512 [ 2094.609023][ T464] loop5: detected capacity change from 0 to 4 [ 2094.626651][ T464] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2094.637464][ T473] EXT4-fs (loop0): bad geometry: block count 1140850816 exceeds size of device (128 blocks) 17:22:32 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xf, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2094.720088][ T473] loop0: detected capacity change from 0 to 512 [ 2094.742189][ T473] EXT4-fs (loop0): bad geometry: block count 1140850816 exceeds size of device (128 blocks) 17:22:32 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 3) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:32 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000020002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:32 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:32 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:32 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xa00}]) 17:22:32 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x10, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2094.947937][ T512] loop0: detected capacity change from 0 to 512 [ 2094.954926][ T513] loop5: detected capacity change from 0 to 4 [ 2094.973844][ T512] EXT4-fs (loop0): bad geometry: block count 1207959680 exceeds size of device (128 blocks) [ 2094.985586][ T513] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2095.029030][ T519] FAULT_INJECTION: forcing a failure. [ 2095.029030][ T519] name failslab, interval 1, probability 0, space 0, times 0 [ 2095.041662][ T519] CPU: 1 PID: 519 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2095.051637][ T519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2095.061770][ T519] Call Trace: [ 2095.065040][ T519] dump_stack_lvl+0xd6/0x122 [ 2095.069647][ T519] dump_stack+0x11/0x1b [ 2095.073806][ T519] should_fail+0x23c/0x250 [ 2095.078218][ T519] ? kcalloc+0x32/0x50 [ 2095.082333][ T519] __should_failslab+0x81/0x90 [ 2095.087088][ T519] should_failslab+0x5/0x20 [ 2095.091587][ T519] __kmalloc+0x6f/0x350 [ 2095.095735][ T519] kcalloc+0x32/0x50 [ 2095.099628][ T519] ext4_find_extent+0x21c/0x7f0 [ 2095.104483][ T519] ? xas_load+0x284/0x2a0 [ 2095.108812][ T519] ? pagecache_get_page+0x781/0x910 [ 2095.114017][ T519] ? PageHuge+0x59/0xc0 [ 2095.118179][ T519] ext4_ext_map_blocks+0x115/0x1ff0 [ 2095.123376][ T519] ? __find_get_block+0x85c/0x930 [ 2095.128405][ T519] ? ext4_es_lookup_extent+0x206/0x490 [ 2095.133899][ T519] ext4_map_blocks+0x1cf/0xf00 [ 2095.138805][ T519] ext4_iomap_begin+0x4b0/0x630 [ 2095.143649][ T519] ? ext4_alloc_da_blocks+0xd0/0xd0 [ 2095.148900][ T519] iomap_iter+0x39c/0x470 [ 2095.153248][ T519] __iomap_dio_rw+0x698/0x1010 [ 2095.158025][ T519] ? __vfs_getxattr+0x264/0x280 [ 2095.162961][ T519] iomap_dio_rw+0x30/0x70 [ 2095.167309][ T519] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2095.172843][ T519] ext4_file_write_iter+0xaa9/0x11f0 17:22:32 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x11, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2095.178128][ T519] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2095.183589][ T519] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2095.189438][ T519] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2095.194824][ T519] ? __list_del_entry_valid+0x54/0xc0 [ 2095.200193][ T519] do_iter_readv_writev+0x2de/0x380 [ 2095.205470][ T519] do_iter_write+0x192/0x5c0 [ 2095.210112][ T519] ? splice_from_pipe_next+0x34f/0x3b0 [ 2095.215569][ T519] ? kmalloc_array+0x2d/0x40 [ 2095.220165][ T519] vfs_iter_write+0x4c/0x70 [ 2095.224669][ T519] iter_file_splice_write+0x43a/0x790 [ 2095.230089][ T519] ? splice_from_pipe+0xd0/0xd0 [ 2095.234937][ T519] do_splice+0x9ca/0xd50 [ 2095.239172][ T519] ? proc_fail_nth_write+0x127/0x150 [ 2095.244460][ T519] ? vfs_write+0x61a/0x900 [ 2095.248869][ T519] ? __fget_light+0x21b/0x260 [ 2095.253542][ T519] __se_sys_splice+0x2bd/0x3a0 [ 2095.258301][ T519] __x64_sys_splice+0x74/0x80 [ 2095.263046][ T519] do_syscall_64+0x44/0xa0 [ 2095.267576][ T519] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2095.273600][ T519] RIP: 0033:0x7f704a8e28d9 [ 2095.278013][ T519] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2095.297619][ T519] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2095.306073][ T519] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2095.314194][ T519] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2095.322166][ T519] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2095.330132][ T519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2095.338096][ T519] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2095.369115][ T513] loop5: detected capacity change from 0 to 4 17:22:33 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xb00}]) 17:22:33 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x4000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2095.376620][ T512] loop0: detected capacity change from 0 to 512 [ 2095.389759][ T512] EXT4-fs (loop0): bad geometry: block count 1207959680 exceeds size of device (128 blocks) [ 2095.400319][ T513] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:33 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000004c06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:33 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000080002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:33 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000006006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2095.491637][ T557] loop0: detected capacity change from 0 to 512 [ 2095.499633][ T557] EXT4-fs (loop0): bad geometry: block count 1275068544 exceeds size of device (128 blocks) [ 2095.527683][ T561] loop5: detected capacity change from 0 to 4 [ 2095.542501][ T561] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2095.554787][ C1] scsi_io_completion_action: 20 callbacks suppressed [ 2095.554814][ C1] sd 0:0:1:0: tag#1562 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2095.571315][ C1] sd 0:0:1:0: tag#1562 CDB: opcode=0xe5 (vendor) [ 2095.577656][ C1] sd 0:0:1:0: tag#1562 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2095.586681][ C1] sd 0:0:1:0: tag#1562 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2095.595717][ C1] sd 0:0:1:0: tag#1562 CDB[20]: ba [ 2095.635403][ T568] loop0: detected capacity change from 0 to 512 [ 2095.643646][ T561] loop5: detected capacity change from 0 to 4 [ 2095.659750][ T568] EXT4-fs (loop0): bad geometry: block count 1610612864 exceeds size of device (128 blocks) [ 2095.676294][ T561] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:33 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 4) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:33 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xc00}]) 17:22:33 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x5000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:33 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000006806000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:33 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001804000080002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:33 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x12, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2095.821534][ T592] loop5: detected capacity change from 0 to 4 [ 2095.835580][ T594] loop0: detected capacity change from 0 to 512 [ 2095.856452][ T592] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2095.871051][ T594] EXT4-fs (loop0): bad geometry: block count 1744830592 exceeds size of device (128 blocks) [ 2095.881551][ T590] FAULT_INJECTION: forcing a failure. [ 2095.881551][ T590] name failslab, interval 1, probability 0, space 0, times 0 [ 2095.894175][ T590] CPU: 1 PID: 590 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2095.898203][ C0] sd 0:0:1:0: tag#1556 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2095.904144][ T590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2095.904157][ T590] Call Trace: [ 2095.904164][ T590] dump_stack_lvl+0xd6/0x122 [ 2095.913975][ C0] sd 0:0:1:0: tag#1556 CDB: opcode=0xe5 (vendor) [ 2095.923987][ T590] dump_stack+0x11/0x1b [ 2095.924009][ T590] should_fail+0x23c/0x250 [ 2095.927292][ C0] sd 0:0:1:0: tag#1556 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2095.931832][ T590] ? __es_insert_extent+0x51f/0xe70 [ 2095.938161][ C0] sd 0:0:1:0: tag#1556 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2095.942265][ T590] __should_failslab+0x81/0x90 [ 2095.946696][ C0] sd 0:0:1:0: tag#1556 CDB[20]: ba [ 2095.955662][ T590] should_failslab+0x5/0x20 [ 2095.984222][ T590] kmem_cache_alloc+0x4f/0x300 [ 2095.988988][ T590] __es_insert_extent+0x51f/0xe70 [ 2095.994009][ T590] ext4_es_insert_extent+0x1cb/0x1950 [ 2095.999386][ T590] ext4_ext_map_blocks+0x100a/0x1ff0 [ 2096.004671][ T590] ? __find_get_block+0x85c/0x930 [ 2096.009695][ T590] ext4_map_blocks+0x1cf/0xf00 [ 2096.010335][ C0] sd 0:0:1:0: tag#1557 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2096.014459][ T590] ext4_iomap_begin+0x4b0/0x630 [ 2096.014485][ T590] ? ext4_alloc_da_blocks+0xd0/0xd0 [ 2096.024292][ C0] sd 0:0:1:0: tag#1557 CDB: opcode=0xe5 (vendor) [ 2096.029083][ T590] iomap_iter+0x39c/0x470 [ 2096.029109][ T590] __iomap_dio_rw+0x698/0x1010 [ 2096.034279][ C0] sd 0:0:1:0: tag#1557 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2096.040567][ T590] ? __vfs_getxattr+0x264/0x280 [ 2096.040588][ T590] iomap_dio_rw+0x30/0x70 [ 2096.044905][ C0] sd 0:0:1:0: tag#1557 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2096.049628][ T590] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2096.059084][ C0] sd 0:0:1:0: tag#1557 CDB[20]: ba [ 2096.063878][ T590] ext4_file_write_iter+0xaa9/0x11f0 [ 2096.093049][ T590] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2096.098566][ T590] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2096.104445][ T590] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2096.109877][ T590] ? __list_del_entry_valid+0x54/0xc0 [ 2096.115334][ T590] do_iter_readv_writev+0x2de/0x380 [ 2096.120539][ T590] do_iter_write+0x192/0x5c0 [ 2096.125206][ T590] ? splice_from_pipe_next+0x34f/0x3b0 [ 2096.130660][ T590] ? kmalloc_array+0x2d/0x40 [ 2096.135252][ T590] vfs_iter_write+0x4c/0x70 [ 2096.139783][ T590] iter_file_splice_write+0x43a/0x790 [ 2096.145202][ T590] ? splice_from_pipe+0xd0/0xd0 [ 2096.150059][ T590] do_splice+0x9ca/0xd50 [ 2096.154304][ T590] ? proc_fail_nth_write+0x127/0x150 [ 2096.159595][ T590] ? vfs_write+0x61a/0x900 [ 2096.164026][ T590] ? __fget_light+0x21b/0x260 [ 2096.168703][ T590] __se_sys_splice+0x2bd/0x3a0 [ 2096.173466][ T590] __x64_sys_splice+0x74/0x80 [ 2096.178138][ T590] do_syscall_64+0x44/0xa0 [ 2096.182591][ T590] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2096.188704][ T590] RIP: 0033:0x7f704a8e28d9 [ 2096.193108][ T590] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2096.212710][ T590] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 17:22:33 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x13, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:33 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x6000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2096.221116][ T590] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2096.229078][ T590] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2096.237043][ T590] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2096.245042][ T590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2096.253191][ T590] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2096.280958][ T592] loop5: detected capacity change from 0 to 4 [ 2096.294992][ T594] loop0: detected capacity change from 0 to 512 [ 2096.301986][ T592] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2096.305418][ T594] EXT4-fs (loop0): bad geometry: block count 1744830592 exceeds size of device (128 blocks) 17:22:33 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000006c06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2096.353499][ C1] sd 0:0:1:0: tag#1560 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2096.363530][ C1] sd 0:0:1:0: tag#1560 CDB: opcode=0xe5 (vendor) [ 2096.369884][ C1] sd 0:0:1:0: tag#1560 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2096.378929][ C1] sd 0:0:1:0: tag#1560 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2096.387997][ C1] sd 0:0:1:0: tag#1560 CDB[20]: ba 17:22:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x14, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:34 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000200002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2096.429221][ C1] sd 0:0:1:0: tag#1561 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2096.439066][ C1] sd 0:0:1:0: tag#1561 CDB: opcode=0xe5 (vendor) [ 2096.445403][ C1] sd 0:0:1:0: tag#1561 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2096.454410][ C1] sd 0:0:1:0: tag#1561 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2096.463436][ C1] sd 0:0:1:0: tag#1561 CDB[20]: ba 17:22:34 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000007406000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2096.521646][ T639] loop5: detected capacity change from 0 to 4 [ 2096.542363][ T642] loop0: detected capacity change from 0 to 512 [ 2096.553182][ T639] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2096.577554][ T642] EXT4-fs (loop0): bad geometry: block count 1946157184 exceeds size of device (128 blocks) 17:22:34 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 5) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:34 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xd00}]) 17:22:34 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x7000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:34 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000400002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2096.623182][ C0] sd 0:0:1:0: tag#1587 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2096.633061][ C0] sd 0:0:1:0: tag#1587 CDB: opcode=0xe5 (vendor) [ 2096.639526][ C0] sd 0:0:1:0: tag#1587 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2096.648577][ C0] sd 0:0:1:0: tag#1587 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2096.657621][ C0] sd 0:0:1:0: tag#1587 CDB[20]: ba [ 2096.688047][ T642] loop0: detected capacity change from 0 to 512 [ 2096.700279][ T657] loop5: detected capacity change from 0 to 4 [ 2096.709053][ T642] EXT4-fs (loop0): bad geometry: block count 1946157184 exceeds size of device (128 blocks) [ 2096.740900][ T657] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2096.750807][ C1] sd 0:0:1:0: tag#1573 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2096.760693][ C1] sd 0:0:1:0: tag#1573 CDB: opcode=0xe5 (vendor) [ 2096.767056][ C1] sd 0:0:1:0: tag#1573 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2096.776086][ C1] sd 0:0:1:0: tag#1573 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2096.782298][ T662] FAULT_INJECTION: forcing a failure. [ 2096.782298][ T662] name failslab, interval 1, probability 0, space 0, times 0 [ 2096.785119][ C1] sd 0:0:1:0: tag#1573 CDB[20]: ba [ 2096.802855][ T662] CPU: 0 PID: 662 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2096.812882][ T662] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2096.822970][ T662] Call Trace: [ 2096.826234][ T662] dump_stack_lvl+0xd6/0x122 [ 2096.830846][ T662] dump_stack+0x11/0x1b [ 2096.835016][ T662] should_fail+0x23c/0x250 [ 2096.839519][ T662] ? kcalloc+0x32/0x50 [ 2096.843582][ T662] __should_failslab+0x81/0x90 [ 2096.848324][ T662] should_failslab+0x5/0x20 [ 2096.852854][ T662] __kmalloc+0x6f/0x350 [ 2096.856988][ T662] kcalloc+0x32/0x50 [ 2096.860867][ T662] ext4_find_extent+0x21c/0x7f0 [ 2096.865718][ T662] ? kfree+0xf8/0x1d0 [ 2096.869677][ T662] ext4_ext_map_blocks+0x115/0x1ff0 [ 2096.874862][ T662] ? __find_get_block+0x85c/0x930 [ 2096.879929][ T662] ext4_map_blocks+0x71e/0xf00 [ 2096.884673][ T662] ext4_iomap_begin+0x4b0/0x630 [ 2096.889506][ T662] ? ext4_alloc_da_blocks+0xd0/0xd0 [ 2096.894693][ T662] iomap_iter+0x39c/0x470 [ 2096.899240][ T662] __iomap_dio_rw+0x698/0x1010 [ 2096.904060][ T662] ? __vfs_getxattr+0x264/0x280 [ 2096.908888][ T662] iomap_dio_rw+0x30/0x70 [ 2096.913200][ T662] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2096.918642][ T662] ext4_file_write_iter+0xaa9/0x11f0 [ 2096.924010][ T662] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2096.929471][ T662] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2096.935320][ T662] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2096.940748][ T662] ? __list_del_entry_valid+0x54/0xc0 [ 2096.946129][ T662] do_iter_readv_writev+0x2de/0x380 [ 2096.951375][ T662] do_iter_write+0x192/0x5c0 [ 2096.955974][ T662] ? splice_from_pipe_next+0x34f/0x3b0 [ 2096.961432][ T662] ? kmalloc_array+0x2d/0x40 [ 2096.966025][ T662] vfs_iter_write+0x4c/0x70 [ 2096.970550][ T662] iter_file_splice_write+0x43a/0x790 [ 2096.975972][ T662] ? splice_from_pipe+0xd0/0xd0 [ 2096.980820][ T662] do_splice+0x9ca/0xd50 [ 2096.985060][ T662] ? proc_fail_nth_write+0x127/0x150 17:22:34 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000102000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:34 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000202000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x15, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2096.990402][ T662] ? vfs_write+0x61a/0x900 [ 2096.994823][ T662] ? __fget_light+0x21b/0x260 [ 2096.999503][ T662] __se_sys_splice+0x2bd/0x3a0 [ 2097.004268][ T662] __x64_sys_splice+0x74/0x80 [ 2097.008942][ T662] do_syscall_64+0x44/0xa0 [ 2097.013385][ T662] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2097.019298][ T662] RIP: 0033:0x7f704a8e28d9 17:22:34 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x7ffffff, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:34 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000007a06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2097.023705][ T662] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2097.043308][ T662] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2097.051719][ T662] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2097.059687][ T662] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2097.067653][ T662] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2097.075795][ T662] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2097.083848][ T662] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2097.138294][ T675] loop5: detected capacity change from 0 to 4 [ 2097.151602][ C1] sd 0:0:1:0: tag#1568 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2097.161451][ C1] sd 0:0:1:0: tag#1568 CDB: opcode=0xe5 (vendor) [ 2097.167797][ C1] sd 0:0:1:0: tag#1568 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2097.176832][ C1] sd 0:0:1:0: tag#1568 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 17:22:34 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xe00}]) [ 2097.185882][ C1] sd 0:0:1:0: tag#1568 CDB[20]: ba [ 2097.186262][ T675] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2097.215129][ T690] loop0: detected capacity change from 0 to 512 [ 2097.235878][ C0] sd 0:0:1:0: tag#1569 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2097.245723][ C0] sd 0:0:1:0: tag#1569 CDB: opcode=0xe5 (vendor) [ 2097.252062][ C0] sd 0:0:1:0: tag#1569 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2097.261286][ C0] sd 0:0:1:0: tag#1569 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2097.270431][ C0] sd 0:0:1:0: tag#1569 CDB[20]: ba 17:22:34 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x8000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:35 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000040202000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2097.352367][ T690] EXT4-fs (loop0): bad geometry: block count 2046820480 exceeds size of device (128 blocks) [ 2097.420184][ T690] loop0: detected capacity change from 0 to 512 [ 2097.430836][ T690] EXT4-fs (loop0): bad geometry: block count 2046820480 exceeds size of device (128 blocks) [ 2097.458172][ T715] loop5: detected capacity change from 0 to 4 17:22:35 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 6) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:35 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x16, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:35 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xf00}]) 17:22:35 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000b606000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2097.477564][ T715] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2097.487103][ C1] sd 0:0:1:0: tag#1560 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2097.496955][ C1] sd 0:0:1:0: tag#1560 CDB: opcode=0xe5 (vendor) [ 2097.503257][ C1] sd 0:0:1:0: tag#1560 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2097.512275][ C1] sd 0:0:1:0: tag#1560 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2097.521308][ C1] sd 0:0:1:0: tag#1560 CDB[20]: ba [ 2097.567143][ T715] loop5: detected capacity change from 0 to 4 [ 2097.586206][ T715] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2097.600033][ T735] loop0: detected capacity change from 0 to 512 [ 2097.614580][ T726] FAULT_INJECTION: forcing a failure. [ 2097.614580][ T726] name failslab, interval 1, probability 0, space 0, times 0 [ 2097.627264][ T726] CPU: 0 PID: 726 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2097.637233][ T726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2097.647308][ T726] Call Trace: [ 2097.650579][ T726] dump_stack_lvl+0xd6/0x122 [ 2097.655170][ T726] dump_stack+0x11/0x1b [ 2097.659327][ T726] should_fail+0x23c/0x250 [ 2097.663743][ T726] ? ext4_mb_new_blocks+0x317/0x1fc0 [ 2097.669094][ T726] __should_failslab+0x81/0x90 [ 2097.673859][ T726] should_failslab+0x5/0x20 [ 2097.678359][ T726] kmem_cache_alloc+0x4f/0x300 [ 2097.683119][ T726] ext4_mb_new_blocks+0x317/0x1fc0 [ 2097.688331][ T726] ? ext4_find_extent+0x6cf/0x7f0 [ 2097.693358][ T726] ? ext4_ext_search_right+0x300/0x540 [ 2097.698816][ T726] ? ext4_inode_to_goal_block+0x1bd/0x1d0 [ 2097.704532][ T726] ext4_ext_map_blocks+0x15ed/0x1ff0 [ 2097.709817][ T726] ? __find_get_block+0x85c/0x930 17:22:35 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x17, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2097.714899][ T726] ext4_map_blocks+0x71e/0xf00 [ 2097.719663][ T726] ext4_iomap_begin+0x4b0/0x630 [ 2097.724518][ T726] ? ext4_alloc_da_blocks+0xd0/0xd0 [ 2097.729721][ T726] iomap_iter+0x39c/0x470 [ 2097.734178][ T726] __iomap_dio_rw+0x698/0x1010 [ 2097.738944][ T726] ? __vfs_getxattr+0x264/0x280 [ 2097.743797][ T726] iomap_dio_rw+0x30/0x70 [ 2097.748115][ T726] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2097.753571][ T726] ext4_file_write_iter+0xaa9/0x11f0 [ 2097.758948][ T726] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2097.764407][ T726] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2097.770213][ T726] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2097.775581][ T726] ? __list_del_entry_valid+0x54/0xc0 [ 2097.780945][ T726] do_iter_readv_writev+0x2de/0x380 [ 2097.786178][ T726] do_iter_write+0x192/0x5c0 [ 2097.790760][ T726] ? splice_from_pipe_next+0x34f/0x3b0 [ 2097.796206][ T726] ? kmalloc_array+0x2d/0x40 [ 2097.800805][ T726] vfs_iter_write+0x4c/0x70 [ 2097.805390][ T726] iter_file_splice_write+0x43a/0x790 [ 2097.810821][ T726] ? splice_from_pipe+0xd0/0xd0 [ 2097.815652][ T726] do_splice+0x9ca/0xd50 [ 2097.819876][ T726] ? proc_fail_nth_write+0x127/0x150 [ 2097.825149][ T726] ? vfs_write+0x61a/0x900 [ 2097.829635][ T726] ? __fget_light+0x21b/0x260 [ 2097.834296][ T726] __se_sys_splice+0x2bd/0x3a0 [ 2097.839044][ T726] __x64_sys_splice+0x74/0x80 [ 2097.843704][ T726] do_syscall_64+0x44/0xa0 [ 2097.848109][ T726] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2097.853991][ T726] RIP: 0033:0x7f704a8e28d9 [ 2097.858402][ T726] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2097.878061][ T726] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2097.886458][ T726] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2097.894481][ T726] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2097.902436][ T726] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2097.910394][ T726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 17:22:35 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x9000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:35 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000302000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2097.918347][ T726] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 17:22:35 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1100}]) 17:22:35 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x18, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2097.999596][ T752] loop5: detected capacity change from 0 to 4 [ 2098.023583][ T752] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:35 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000402000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2098.073711][ T735] EXT4-fs (loop0): bad geometry: block count 3053453440 exceeds size of device (128 blocks) [ 2098.085584][ T752] loop5: detected capacity change from 0 to 4 [ 2098.100352][ T752] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2098.140775][ T735] loop0: detected capacity change from 0 to 512 [ 2098.161823][ T735] EXT4-fs (loop0): bad geometry: block count 3053453440 exceeds size of device (128 blocks) 17:22:35 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000fe06000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:35 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xa000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2098.195172][ T779] loop5: detected capacity change from 0 to 4 [ 2098.223596][ T779] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2098.250853][ T784] loop0: detected capacity change from 0 to 512 [ 2098.275868][ T779] loop5: detected capacity change from 0 to 4 [ 2098.285654][ T779] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2098.292925][ T784] EXT4-fs (loop0): bad geometry: block count 4261412992 exceeds size of device (128 blocks) 17:22:36 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 7) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:36 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1200}]) 17:22:36 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000502000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:36 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x19, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2098.394983][ T784] loop0: detected capacity change from 0 to 512 [ 2098.408352][ T784] EXT4-fs (loop0): bad geometry: block count 4261412992 exceeds size of device (128 blocks) 17:22:36 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xb000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2098.441351][ T814] loop5: detected capacity change from 0 to 4 [ 2098.451167][ T814] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:36 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000007000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:36 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000602000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2098.509433][ T813] FAULT_INJECTION: forcing a failure. [ 2098.509433][ T813] name failslab, interval 1, probability 0, space 0, times 0 [ 2098.522106][ T813] CPU: 0 PID: 813 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2098.532119][ T813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2098.542293][ T813] Call Trace: [ 2098.545563][ T813] dump_stack_lvl+0xd6/0x122 [ 2098.550231][ T813] dump_stack+0x11/0x1b [ 2098.554397][ T813] should_fail+0x23c/0x250 [ 2098.558819][ T813] ? __es_insert_extent+0x51f/0xe70 [ 2098.564019][ T813] __should_failslab+0x81/0x90 [ 2098.568833][ T813] should_failslab+0x5/0x20 [ 2098.573338][ T813] kmem_cache_alloc+0x4f/0x300 [ 2098.578107][ T813] __es_insert_extent+0x51f/0xe70 [ 2098.583151][ T813] ext4_es_insert_extent+0x1cb/0x1950 [ 2098.588524][ T813] ext4_map_blocks+0xa5d/0xf00 [ 2098.593319][ T813] ext4_iomap_begin+0x4b0/0x630 [ 2098.598170][ T813] ? ext4_alloc_da_blocks+0xd0/0xd0 [ 2098.603370][ T813] iomap_iter+0x39c/0x470 17:22:36 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xc000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2098.607779][ T813] __iomap_dio_rw+0x698/0x1010 [ 2098.612625][ T813] ? __vfs_getxattr+0x264/0x280 [ 2098.617479][ T813] iomap_dio_rw+0x30/0x70 [ 2098.621885][ T813] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2098.627401][ T813] ext4_file_write_iter+0xaa9/0x11f0 [ 2098.632768][ T813] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2098.638230][ T813] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2098.644044][ T813] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2098.649426][ T813] ? __list_del_entry_valid+0x54/0xc0 [ 2098.654804][ T813] do_iter_readv_writev+0x2de/0x380 [ 2098.660034][ T813] do_iter_write+0x192/0x5c0 [ 2098.664630][ T813] ? splice_from_pipe_next+0x34f/0x3b0 [ 2098.665756][ T839] loop5: detected capacity change from 0 to 4 [ 2098.670117][ T813] ? kmalloc_array+0x2d/0x40 [ 2098.670145][ T813] vfs_iter_write+0x4c/0x70 [ 2098.685244][ T813] iter_file_splice_write+0x43a/0x790 [ 2098.690613][ T813] ? splice_from_pipe+0xd0/0xd0 [ 2098.695462][ T813] do_splice+0x9ca/0xd50 [ 2098.699750][ T813] ? proc_fail_nth_write+0x127/0x150 [ 2098.705043][ T813] ? vfs_write+0x61a/0x900 [ 2098.709460][ T813] ? __fget_light+0x21b/0x260 [ 2098.714145][ T813] __se_sys_splice+0x2bd/0x3a0 [ 2098.718964][ T813] __x64_sys_splice+0x74/0x80 [ 2098.723629][ T813] do_syscall_64+0x44/0xa0 [ 2098.728102][ T813] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2098.733987][ T813] RIP: 0033:0x7f704a8e28d9 [ 2098.738385][ T813] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2098.757994][ T813] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2098.766439][ T813] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2098.774398][ T813] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2098.782352][ T813] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2098.790431][ T813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2098.798389][ T813] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2098.816134][ T833] loop0: detected capacity change from 0 to 512 [ 2098.840809][ T839] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:36 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xd000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:36 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1300}]) 17:22:36 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000009000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2098.863691][ T833] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2098.888532][ T839] loop5: detected capacity change from 0 to 4 [ 2098.899306][ T839] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:36 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000040602000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2098.972448][ T867] loop0: detected capacity change from 0 to 512 [ 2099.028260][ T877] loop5: detected capacity change from 0 to 4 [ 2099.050149][ T867] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2099.081725][ T877] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2099.136073][ T877] loop5: detected capacity change from 0 to 4 [ 2099.148978][ T877] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:36 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 8) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:36 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1a, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:36 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000a000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:36 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xe000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:36 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1400}]) 17:22:36 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000702000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2099.295151][ T906] loop5: detected capacity change from 0 to 4 [ 2099.301557][ T903] loop0: detected capacity change from 0 to 512 [ 2099.313938][ T906] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2099.344808][ T903] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2099.360275][ T905] FAULT_INJECTION: forcing a failure. [ 2099.360275][ T905] name failslab, interval 1, probability 0, space 0, times 0 [ 2099.372930][ T905] CPU: 0 PID: 905 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2099.382920][ T905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2099.392974][ T905] Call Trace: [ 2099.396307][ T905] dump_stack_lvl+0xd6/0x122 [ 2099.400902][ T905] dump_stack+0x11/0x1b [ 2099.405064][ T905] should_fail+0x23c/0x250 [ 2099.409500][ T905] ? mempool_alloc_slab+0x16/0x20 [ 2099.414522][ T905] __should_failslab+0x81/0x90 [ 2099.419292][ T905] should_failslab+0x5/0x20 [ 2099.423805][ T905] kmem_cache_alloc+0x4f/0x300 [ 2099.428573][ T905] ? ext4_fc_track_range+0x90/0x140 [ 2099.433922][ T905] mempool_alloc_slab+0x16/0x20 [ 2099.438773][ T905] ? mempool_free+0x130/0x130 [ 2099.443453][ T905] mempool_alloc+0x9d/0x310 [ 2099.447955][ T905] bio_alloc_bioset+0xcc/0x530 [ 2099.452719][ T905] ? iov_iter_alignment+0x34b/0x370 [ 2099.457913][ T905] iomap_dio_bio_iter+0x5c1/0xbc0 [ 2099.462951][ T905] __iomap_dio_rw+0x8d8/0x1010 [ 2099.467722][ T905] iomap_dio_rw+0x30/0x70 [ 2099.472169][ T905] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2099.477643][ T905] ext4_file_write_iter+0xaa9/0x11f0 [ 2099.483015][ T905] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2099.488477][ T905] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2099.494293][ T905] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2099.499698][ T905] ? __list_del_entry_valid+0x54/0xc0 [ 2099.505075][ T905] do_iter_readv_writev+0x2de/0x380 [ 2099.510381][ T905] do_iter_write+0x192/0x5c0 [ 2099.514973][ T905] ? splice_from_pipe_next+0x34f/0x3b0 [ 2099.520502][ T905] ? kmalloc_array+0x2d/0x40 [ 2099.525102][ T905] vfs_iter_write+0x4c/0x70 [ 2099.529607][ T905] iter_file_splice_write+0x43a/0x790 [ 2099.535027][ T905] ? splice_from_pipe+0xd0/0xd0 [ 2099.539871][ T905] do_splice+0x9ca/0xd50 [ 2099.544202][ T905] ? proc_fail_nth_write+0x127/0x150 [ 2099.549492][ T905] ? vfs_write+0x61a/0x900 [ 2099.553912][ T905] ? __fget_light+0x21b/0x260 [ 2099.558598][ T905] __se_sys_splice+0x2bd/0x3a0 [ 2099.563361][ T905] __x64_sys_splice+0x74/0x80 [ 2099.568052][ T905] do_syscall_64+0x44/0xa0 [ 2099.572500][ T905] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2099.578435][ T905] RIP: 0033:0x7f704a8e28d9 [ 2099.582847][ T905] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2099.602451][ T905] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2099.610856][ T905] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2099.618827][ T905] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2099.626845][ T905] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2099.634816][ T905] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 17:22:37 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000b000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2099.642784][ T905] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2099.655959][ T906] loop5: detected capacity change from 0 to 4 [ 2099.676678][ T906] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:37 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1500}]) 17:22:37 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000802000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2099.753631][ T943] loop0: detected capacity change from 0 to 512 [ 2099.788105][ T943] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:37 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000c000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2099.825103][ T950] loop5: detected capacity change from 0 to 4 [ 2099.848986][ T950] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:37 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xf000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2099.887099][ T950] loop5: detected capacity change from 0 to 4 [ 2099.905249][ T950] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:37 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1600}]) [ 2099.952217][ T966] loop0: detected capacity change from 0 to 512 [ 2099.998703][ T966] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:37 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 9) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:37 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000902000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:37 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1b, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:37 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000010e000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:37 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x10000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:37 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1700}]) [ 2100.142933][ T992] loop0: detected capacity change from 0 to 512 [ 2100.158353][ T1003] loop5: detected capacity change from 0 to 4 [ 2100.166973][ T992] EXT4-fs (loop0): bad geometry: block count 16777344 exceeds size of device (128 blocks) [ 2100.196168][ T1003] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2100.241860][ T1006] FAULT_INJECTION: forcing a failure. [ 2100.241860][ T1006] name failslab, interval 1, probability 0, space 0, times 0 [ 2100.254577][ T1006] CPU: 0 PID: 1006 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2100.264646][ T1006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2100.274775][ T1006] Call Trace: [ 2100.278052][ T1006] dump_stack_lvl+0xd6/0x122 [ 2100.282647][ T1006] dump_stack+0x11/0x1b [ 2100.286794][ T1006] should_fail+0x23c/0x250 17:22:37 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1c, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2100.291224][ T1006] __should_failslab+0x81/0x90 [ 2100.296043][ T1006] should_failslab+0x5/0x20 [ 2100.300624][ T1006] kmem_cache_alloc_node+0x61/0x2c0 [ 2100.305825][ T1006] ? create_task_io_context+0x36/0x210 [ 2100.311364][ T1006] create_task_io_context+0x36/0x210 [ 2100.316652][ T1006] submit_bio_checks+0x7c3/0x850 [ 2100.321638][ T1006] submit_bio_noacct+0x33/0x7d0 [ 2100.326628][ T1006] submit_bio+0x10c/0x190 [ 2100.330964][ T1006] iomap_dio_bio_iter+0x990/0xbc0 [ 2100.336024][ T1006] __iomap_dio_rw+0x8d8/0x1010 [ 2100.340798][ T1006] iomap_dio_rw+0x30/0x70 [ 2100.345173][ T1006] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2100.350635][ T1006] ext4_file_write_iter+0xaa9/0x11f0 [ 2100.355986][ T1006] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2100.361559][ T1006] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2100.367420][ T1006] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2100.372825][ T1006] ? __list_del_entry_valid+0x54/0xc0 [ 2100.378211][ T1006] do_iter_readv_writev+0x2de/0x380 [ 2100.383420][ T1006] do_iter_write+0x192/0x5c0 [ 2100.388128][ T1006] ? splice_from_pipe_next+0x34f/0x3b0 [ 2100.393637][ T1006] ? kmalloc_array+0x2d/0x40 [ 2100.398235][ T1006] vfs_iter_write+0x4c/0x70 [ 2100.402739][ T1006] iter_file_splice_write+0x43a/0x790 [ 2100.408119][ T1006] ? splice_from_pipe+0xd0/0xd0 [ 2100.412994][ T1006] do_splice+0x9ca/0xd50 [ 2100.417235][ T1006] ? proc_fail_nth_write+0x127/0x150 [ 2100.422523][ T1006] ? vfs_write+0x61a/0x900 [ 2100.426992][ T1006] ? __fget_light+0x21b/0x260 [ 2100.431672][ T1006] __se_sys_splice+0x2bd/0x3a0 [ 2100.436437][ T1006] __x64_sys_splice+0x74/0x80 [ 2100.441211][ T1006] do_syscall_64+0x44/0xa0 [ 2100.445634][ T1006] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2100.451628][ T1006] RIP: 0033:0x7f704a8e28d9 [ 2100.456057][ T1006] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2100.475659][ T1006] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2100.484068][ T1006] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2100.492038][ T1006] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2100.500003][ T1006] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2100.508001][ T1006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2100.515973][ T1006] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2100.532925][ T992] loop0: detected capacity change from 0 to 512 17:22:38 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x11000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:38 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000f000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:38 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x2000}]) [ 2100.540705][ T1003] loop5: detected capacity change from 0 to 4 [ 2100.548428][ T992] EXT4-fs (loop0): bad geometry: block count 16777344 exceeds size of device (128 blocks) [ 2100.564382][ T1003] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:38 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000a02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2100.622574][ T1046] loop0: detected capacity change from 0 to 512 [ 2100.652167][ T1046] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:38 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000011000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2100.678635][ T1061] loop5: detected capacity change from 0 to 4 [ 2100.698837][ T1061] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2100.720409][ C0] scsi_io_completion_action: 14 callbacks suppressed [ 2100.720440][ C0] sd 0:0:1:0: tag#1551 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2100.736994][ C0] sd 0:0:1:0: tag#1551 CDB: opcode=0xe5 (vendor) [ 2100.743336][ C0] sd 0:0:1:0: tag#1551 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2100.752385][ C0] sd 0:0:1:0: tag#1551 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2100.761450][ C0] sd 0:0:1:0: tag#1551 CDB[20]: ba [ 2100.803830][ T1061] loop5: detected capacity change from 0 to 4 [ 2100.833178][ T1061] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2100.852590][ T1076] loop0: detected capacity change from 0 to 512 [ 2100.880838][ T1076] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:38 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 10) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:38 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000b02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:38 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x12000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:38 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000003f000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:38 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1d, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:38 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x2200}]) [ 2101.047060][ T1110] loop5: detected capacity change from 0 to 4 [ 2101.061868][ T1111] loop0: detected capacity change from 0 to 512 [ 2101.070854][ T1110] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2101.076974][ T1093] FAULT_INJECTION: forcing a failure. [ 2101.076974][ T1093] name failslab, interval 1, probability 0, space 0, times 0 [ 2101.090066][ T1093] CPU: 1 PID: 1093 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2101.095796][ C0] sd 0:0:1:0: tag#1548 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2101.100141][ T1093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2101.100155][ T1093] Call Trace: [ 2101.100162][ T1093] dump_stack_lvl+0xd6/0x122 [ 2101.109987][ C0] sd 0:0:1:0: tag#1548 CDB: opcode=0xe5 (vendor) [ 2101.119997][ T1093] dump_stack+0x11/0x1b [ 2101.123292][ C0] sd 0:0:1:0: tag#1548 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2101.127851][ T1093] should_fail+0x23c/0x250 [ 2101.134221][ C0] sd 0:0:1:0: tag#1548 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2101.138332][ T1093] ? mempool_alloc_slab+0x16/0x20 [ 2101.147362][ C0] sd 0:0:1:0: tag#1548 CDB[20]: ba [ 2101.151719][ T1093] __should_failslab+0x81/0x90 [ 2101.175548][ T1093] should_failslab+0x5/0x20 [ 2101.180109][ T1093] kmem_cache_alloc+0x4f/0x300 [ 2101.184870][ T1093] mempool_alloc_slab+0x16/0x20 [ 2101.189720][ T1093] ? mempool_free+0x130/0x130 [ 2101.194386][ T1093] mempool_alloc+0x9d/0x310 [ 2101.198880][ T1093] ? chksum_update+0x39/0x50 [ 2101.203469][ T1093] ? crypto_shash_update+0x13c/0x1a0 [ 2101.208752][ T1093] sg_pool_alloc+0x74/0x90 [ 2101.213169][ T1093] __sg_alloc_table+0xce/0x290 [ 2101.217963][ T1093] sg_alloc_table_chained+0xaf/0x140 [ 2101.223286][ T1093] ? sg_alloc_table_chained+0x140/0x140 [ 2101.228872][ T1093] scsi_alloc_sgtables+0x184/0x510 [ 2101.233971][ T1093] sd_init_command+0x952/0x1610 [ 2101.238803][ T1093] scsi_queue_rq+0x10cd/0x15a0 [ 2101.243552][ T1093] blk_mq_dispatch_rq_list+0x63b/0x1080 [ 2101.249086][ T1093] blk_mq_do_dispatch_sched+0x3b5/0x640 [ 2101.254642][ T1093] __blk_mq_sched_dispatch_requests+0x1eb/0x290 [ 2101.260875][ T1093] ? rb_insert_color+0x2fa/0x310 [ 2101.265803][ T1093] blk_mq_sched_dispatch_requests+0x9f/0x110 [ 2101.271765][ T1093] __blk_mq_run_hw_queue+0xbc/0x140 [ 2101.276949][ T1093] __blk_mq_delay_run_hw_queue+0x163/0x2f0 [ 2101.282741][ T1093] blk_mq_run_hw_queue+0x22c/0x250 [ 2101.287841][ T1093] blk_mq_sched_insert_requests+0x12b/0x1f0 [ 2101.293822][ T1093] blk_mq_flush_plug_list+0x302/0x3d0 [ 2101.299194][ T1093] blk_flush_plug_list+0x235/0x260 [ 2101.304294][ T1093] blk_finish_plug+0x44/0x60 [ 2101.308909][ T1093] __iomap_dio_rw+0xca7/0x1010 [ 2101.313672][ T1093] iomap_dio_rw+0x30/0x70 [ 2101.318141][ T1093] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2101.323645][ T1093] ext4_file_write_iter+0xaa9/0x11f0 [ 2101.328961][ T1093] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2101.334455][ T1093] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2101.340254][ T1093] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2101.345631][ T1093] ? __list_del_entry_valid+0x54/0xc0 [ 2101.350990][ T1093] do_iter_readv_writev+0x2de/0x380 [ 2101.356258][ T1093] do_iter_write+0x192/0x5c0 [ 2101.360835][ T1093] ? splice_from_pipe_next+0x34f/0x3b0 [ 2101.366276][ T1093] ? kmalloc_array+0x2d/0x40 [ 2101.370856][ T1093] vfs_iter_write+0x4c/0x70 [ 2101.375344][ T1093] iter_file_splice_write+0x43a/0x790 [ 2101.380754][ T1093] ? splice_from_pipe+0xd0/0xd0 [ 2101.385588][ T1093] do_splice+0x9ca/0xd50 [ 2101.389819][ T1093] ? proc_fail_nth_write+0x127/0x150 [ 2101.395123][ T1093] ? vfs_write+0x61a/0x900 [ 2101.399529][ T1093] ? __fget_light+0x21b/0x260 [ 2101.404244][ T1093] __se_sys_splice+0x2bd/0x3a0 [ 2101.408989][ T1093] __x64_sys_splice+0x74/0x80 [ 2101.413660][ T1093] do_syscall_64+0x44/0xa0 [ 2101.418064][ T1093] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2101.423962][ T1093] RIP: 0033:0x7f704a8e28d9 [ 2101.428359][ T1093] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2101.447954][ T1093] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2101.456349][ T1093] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2101.464304][ T1093] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2101.472259][ T1093] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2101.480265][ T1093] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2101.488218][ T1093] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2101.497126][ C0] sd 0:0:1:0: tag#1549 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2101.506988][ C0] sd 0:0:1:0: tag#1549 CDB: opcode=0xe5 (vendor) [ 2101.513324][ C0] sd 0:0:1:0: tag#1549 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2101.522385][ C0] sd 0:0:1:0: tag#1549 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2101.531438][ C0] sd 0:0:1:0: tag#1549 CDB[20]: ba 17:22:39 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x13000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:39 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000040000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2101.585636][ T1110] loop5: detected capacity change from 0 to 4 [ 2101.593764][ T1111] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2101.618467][ T1110] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:39 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x3f00}]) 17:22:39 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000c02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:39 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1e, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2101.690599][ T1148] loop0: detected capacity change from 0 to 512 [ 2101.723950][ T1159] loop5: detected capacity change from 0 to 4 [ 2101.733129][ C1] sd 0:0:1:0: tag#1549 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2101.743101][ C1] sd 0:0:1:0: tag#1549 CDB: opcode=0xe5 (vendor) [ 2101.749477][ C1] sd 0:0:1:0: tag#1549 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2101.758534][ C1] sd 0:0:1:0: tag#1549 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2101.767579][ C1] sd 0:0:1:0: tag#1549 CDB[20]: ba [ 2101.778147][ T1159] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:39 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000d02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2101.791126][ T1148] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:39 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 11) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) [ 2101.874381][ T1093] syz-executor.4 (1093) used greatest stack depth: 10064 bytes left [ 2101.883722][ T1176] loop5: detected capacity change from 0 to 4 [ 2101.891350][ C1] sd 0:0:1:0: tag#1551 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2101.901223][ C1] sd 0:0:1:0: tag#1551 CDB: opcode=0xe5 (vendor) [ 2101.907585][ C1] sd 0:0:1:0: tag#1551 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 17:22:39 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x14000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:39 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000fe000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2101.916631][ C1] sd 0:0:1:0: tag#1551 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2101.925668][ C1] sd 0:0:1:0: tag#1551 CDB[20]: ba [ 2101.980268][ T1176] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2101.999243][ T1180] FAULT_INJECTION: forcing a failure. [ 2101.999243][ T1180] name failslab, interval 1, probability 0, space 0, times 0 [ 2102.011943][ T1180] CPU: 1 PID: 1180 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2102.022004][ T1180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2102.032120][ T1180] Call Trace: [ 2102.035402][ T1180] dump_stack_lvl+0xd6/0x122 [ 2102.039997][ T1180] dump_stack+0x11/0x1b [ 2102.044156][ T1180] should_fail+0x23c/0x250 [ 2102.044608][ C0] sd 0:0:1:0: tag#1570 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2102.048592][ T1180] ? mempool_alloc_slab+0x16/0x20 [ 2102.048613][ T1180] __should_failslab+0x81/0x90 [ 2102.048631][ T1180] should_failslab+0x5/0x20 [ 2102.058561][ C0] sd 0:0:1:0: tag#1570 CDB: opcode=0xe5 (vendor) [ 2102.063534][ T1180] kmem_cache_alloc+0x4f/0x300 [ 2102.068307][ C0] sd 0:0:1:0: tag#1570 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2102.072773][ T1180] mempool_alloc_slab+0x16/0x20 [ 2102.079098][ C0] sd 0:0:1:0: tag#1570 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2102.083817][ T1180] ? mempool_free+0x130/0x130 [ 2102.083835][ T1180] mempool_alloc+0x9d/0x310 [ 2102.092842][ C0] sd 0:0:1:0: tag#1570 CDB[20]: ba [ 2102.097682][ T1180] ? __getblk_gfp+0x3f/0x590 [ 2102.125743][ T1180] bio_alloc_bioset+0xcc/0x530 17:22:39 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x21, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2102.130515][ T1180] ? __ext4_get_inode_loc+0x7fb/0x960 [ 2102.135897][ T1180] submit_bh_wbc+0x130/0x330 [ 2102.140490][ T1180] __sync_dirty_buffer+0x136/0x1e0 [ 2102.145596][ T1180] sync_dirty_buffer+0x16/0x20 [ 2102.150383][ T1180] ext4_write_inode+0x2ad/0x3c0 [ 2102.155292][ T1180] write_inode+0x89/0x180 [ 2102.159661][ T1180] __writeback_single_inode+0x2a2/0x440 [ 2102.165214][ T1180] writeback_single_inode+0x17b/0x3e0 [ 2102.170593][ T1180] sync_inode_metadata+0x57/0x80 [ 2102.175534][ T1180] ext4_sync_file+0x359/0x670 [ 2102.180209][ T1180] ? tsan.module_ctor+0x10/0x10 [ 2102.185058][ T1180] vfs_fsync_range+0x107/0x120 [ 2102.189904][ T1180] iomap_dio_complete+0x2d5/0x3c0 [ 2102.195011][ T1180] iomap_dio_rw+0x4e/0x70 [ 2102.199366][ T1180] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2102.204824][ T1180] ext4_file_write_iter+0xaa9/0x11f0 [ 2102.210206][ T1180] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2102.215662][ T1180] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2102.221537][ T1180] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2102.226935][ T1180] ? __list_del_entry_valid+0x54/0xc0 [ 2102.232312][ T1180] do_iter_readv_writev+0x2de/0x380 [ 2102.237604][ T1180] do_iter_write+0x192/0x5c0 [ 2102.242198][ T1180] ? splice_from_pipe_next+0x34f/0x3b0 [ 2102.247658][ T1180] ? kmalloc_array+0x2d/0x40 [ 2102.252253][ T1180] vfs_iter_write+0x4c/0x70 [ 2102.256885][ T1180] iter_file_splice_write+0x43a/0x790 [ 2102.262253][ T1180] ? splice_from_pipe+0xd0/0xd0 [ 2102.267100][ T1180] do_splice+0x9ca/0xd50 [ 2102.271341][ T1180] ? proc_fail_nth_write+0x127/0x150 [ 2102.276770][ T1180] ? vfs_write+0x61a/0x900 [ 2102.281227][ T1180] ? __fget_light+0x21b/0x260 [ 2102.285932][ T1180] __se_sys_splice+0x2bd/0x3a0 [ 2102.289148][ C0] sd 0:0:1:0: tag#1541 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2102.290693][ T1180] __x64_sys_splice+0x74/0x80 [ 2102.290714][ T1180] do_syscall_64+0x44/0xa0 [ 2102.300616][ C0] sd 0:0:1:0: tag#1541 CDB: opcode=0xe5 (vendor) [ 2102.305241][ T1180] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2102.305269][ T1180] RIP: 0033:0x7f704a8e28d9 [ 2102.309661][ C0] sd 0:0:1:0: tag#1541 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2102.315950][ T1180] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2102.321845][ C0] sd 0:0:1:0: tag#1541 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2102.326226][ T1180] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2102.326246][ T1180] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2102.335254][ C0] sd 0:0:1:0: tag#1541 CDB[20]: ba [ 2102.355024][ T1180] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2102.355039][ T1180] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2102.355051][ T1180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2102.409832][ T1180] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 17:22:40 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000fffe000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x15000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2102.435037][ T1176] loop5: detected capacity change from 0 to 4 [ 2102.446911][ T1199] loop0: detected capacity change from 0 to 512 [ 2102.457914][ T1199] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2102.468687][ T1176] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:40 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x4000}]) 17:22:40 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000e02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2102.544461][ T1207] loop0: detected capacity change from 0 to 512 [ 2102.558484][ T1207] EXT4-fs (loop0): bad geometry: block count 4278190208 exceeds size of device (128 blocks) [ 2102.600975][ T1222] loop5: detected capacity change from 0 to 4 [ 2102.618115][ T1222] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2102.627742][ C0] sd 0:0:1:0: tag#1541 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2102.637620][ C0] sd 0:0:1:0: tag#1541 CDB: opcode=0xe5 (vendor) [ 2102.643976][ C0] sd 0:0:1:0: tag#1541 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2102.653008][ C0] sd 0:0:1:0: tag#1541 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2102.662069][ C0] sd 0:0:1:0: tag#1541 CDB[20]: ba [ 2102.675354][ T1207] loop0: detected capacity change from 0 to 512 17:22:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x16000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:40 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 12) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) [ 2102.702060][ T1207] EXT4-fs (loop0): bad geometry: block count 4278190208 exceeds size of device (128 blocks) 17:22:40 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x22, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:40 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000002000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2102.765268][ T1222] loop5: detected capacity change from 0 to 4 17:22:40 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000001002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2102.837993][ T1253] loop0: detected capacity change from 0 to 512 [ 2102.855994][ T1244] FAULT_INJECTION: forcing a failure. [ 2102.855994][ T1244] name failslab, interval 1, probability 0, space 0, times 0 [ 2102.868623][ T1244] CPU: 1 PID: 1244 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2102.878689][ T1244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2102.888744][ T1244] Call Trace: [ 2102.892011][ T1244] dump_stack_lvl+0xd6/0x122 [ 2102.896714][ T1244] dump_stack+0x11/0x1b [ 2102.900872][ T1244] should_fail+0x23c/0x250 [ 2102.905287][ T1244] ? mempool_alloc_slab+0x16/0x20 [ 2102.910313][ T1244] __should_failslab+0x81/0x90 [ 2102.915171][ T1244] should_failslab+0x5/0x20 [ 2102.919678][ T1244] kmem_cache_alloc+0x4f/0x300 [ 2102.924442][ T1244] mempool_alloc_slab+0x16/0x20 [ 2102.929342][ T1244] ? mempool_free+0x130/0x130 [ 2102.934013][ T1244] mempool_alloc+0x9d/0x310 [ 2102.938512][ T1244] ? __getblk_gfp+0x3f/0x590 [ 2102.943106][ T1244] bio_alloc_bioset+0xcc/0x530 [ 2102.947947][ T1244] ? __ext4_get_inode_loc+0x7fb/0x960 [ 2102.953325][ T1244] submit_bh_wbc+0x130/0x330 [ 2102.957914][ T1244] __sync_dirty_buffer+0x136/0x1e0 [ 2102.963027][ T1244] sync_dirty_buffer+0x16/0x20 [ 2102.967788][ T1244] ext4_write_inode+0x2ad/0x3c0 [ 2102.972643][ T1244] write_inode+0x89/0x180 [ 2102.976981][ T1244] __writeback_single_inode+0x2a2/0x440 [ 2102.982590][ T1244] writeback_single_inode+0x17b/0x3e0 17:22:40 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x60ff}]) [ 2102.987982][ T1244] sync_inode_metadata+0x57/0x80 [ 2102.992929][ T1244] ext4_sync_file+0x359/0x670 [ 2102.997610][ T1244] ? tsan.module_ctor+0x10/0x10 [ 2103.002527][ T1244] vfs_fsync_range+0x107/0x120 [ 2103.007287][ T1244] iomap_dio_complete+0x2d5/0x3c0 [ 2103.012422][ T1244] iomap_dio_rw+0x4e/0x70 [ 2103.016782][ T1244] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2103.022258][ T1244] ext4_file_write_iter+0xaa9/0x11f0 [ 2103.028067][ T1244] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2103.030873][ C0] sd 0:0:1:0: tag#1578 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2103.033528][ T1244] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2103.033556][ T1244] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2103.043379][ C0] sd 0:0:1:0: tag#1578 CDB: opcode=0xe5 (vendor) [ 2103.049141][ T1244] ? __list_del_entry_valid+0x54/0xc0 [ 2103.054532][ C0] sd 0:0:1:0: tag#1578 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2103.060847][ T1244] do_iter_readv_writev+0x2de/0x380 [ 2103.066220][ C0] sd 0:0:1:0: tag#1578 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2103.075187][ T1244] do_iter_write+0x192/0x5c0 [ 2103.080383][ C0] sd 0:0:1:0: tag#1578 CDB[20]: ba [ 2103.089453][ T1244] ? splice_from_pipe_next+0x34f/0x3b0 [ 2103.089474][ T1244] ? kmalloc_array+0x2d/0x40 [ 2103.109214][ T1244] vfs_iter_write+0x4c/0x70 [ 2103.113660][ C0] sd 0:0:1:0: tag#1579 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2103.113757][ T1244] iter_file_splice_write+0x43a/0x790 [ 2103.123582][ C0] sd 0:0:1:0: tag#1579 CDB: opcode=0xe5 (vendor) [ 2103.128885][ T1244] ? splice_from_pipe+0xd0/0xd0 [ 2103.135307][ C0] sd 0:0:1:0: tag#1579 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2103.140101][ T1244] do_splice+0x9ca/0xd50 [ 2103.149121][ C0] sd 0:0:1:0: tag#1579 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2103.153331][ T1244] ? proc_fail_nth_write+0x127/0x150 [ 2103.162880][ C0] sd 0:0:1:0: tag#1579 CDB[20]: ba [ 2103.168119][ T1244] ? vfs_write+0x61a/0x900 [ 2103.168142][ T1244] ? __fget_light+0x21b/0x260 [ 2103.182274][ T1244] __se_sys_splice+0x2bd/0x3a0 [ 2103.187036][ T1244] __x64_sys_splice+0x74/0x80 [ 2103.191711][ T1244] do_syscall_64+0x44/0xa0 [ 2103.196127][ T1244] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2103.202023][ T1244] RIP: 0033:0x7f704a8e28d9 [ 2103.206458][ T1244] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2103.226063][ T1244] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2103.234500][ T1244] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2103.242468][ T1244] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2103.250436][ T1244] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2103.258430][ T1244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2103.266399][ T1244] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 17:22:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x17000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2103.310314][ T1258] loop5: detected capacity change from 0 to 4 [ 2103.340506][ T1253] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2103.351449][ T1258] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:41 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000004000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x23, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:41 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xff01}]) [ 2103.451510][ T1258] loop5: detected capacity change from 0 to 4 [ 2103.472880][ T1258] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:41 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x18000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2103.500274][ T1290] loop0: detected capacity change from 0 to 512 [ 2103.531139][ T1290] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:41 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000001102000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:41 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000005000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 13) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) [ 2103.649650][ T1312] loop5: detected capacity change from 0 to 4 [ 2103.673872][ T1310] loop0: detected capacity change from 0 to 512 [ 2103.687551][ T1312] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2103.698008][ T1310] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2103.713184][ T1308] FAULT_INJECTION: forcing a failure. [ 2103.713184][ T1308] name failslab, interval 1, probability 0, space 0, times 0 [ 2103.725809][ T1308] CPU: 0 PID: 1308 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2103.735877][ T1308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2103.745927][ T1308] Call Trace: [ 2103.749281][ T1308] dump_stack_lvl+0xd6/0x122 [ 2103.753895][ T1308] dump_stack+0x11/0x1b [ 2103.758055][ T1308] should_fail+0x23c/0x250 [ 2103.762475][ T1308] ? mempool_alloc_slab+0x16/0x20 [ 2103.767512][ T1308] __should_failslab+0x81/0x90 [ 2103.772275][ T1308] should_failslab+0x5/0x20 [ 2103.776783][ T1308] kmem_cache_alloc+0x4f/0x300 [ 2103.781576][ T1308] mempool_alloc_slab+0x16/0x20 [ 2103.786443][ T1308] ? mempool_free+0x130/0x130 [ 2103.791112][ T1308] mempool_alloc+0x9d/0x310 [ 2103.795643][ T1308] ? __getblk_gfp+0x3f/0x590 [ 2103.800269][ T1308] bio_alloc_bioset+0xcc/0x530 [ 2103.805112][ T1308] ? __ext4_get_inode_loc+0x7fb/0x960 [ 2103.810581][ T1308] submit_bh_wbc+0x130/0x330 [ 2103.815187][ T1308] __sync_dirty_buffer+0x136/0x1e0 [ 2103.820295][ T1308] sync_dirty_buffer+0x16/0x20 [ 2103.825055][ T1308] ext4_write_inode+0x2ad/0x3c0 [ 2103.829911][ T1308] write_inode+0x89/0x180 [ 2103.834314][ T1308] __writeback_single_inode+0x2a2/0x440 [ 2103.839934][ T1308] writeback_single_inode+0x17b/0x3e0 [ 2103.845320][ T1308] sync_inode_metadata+0x57/0x80 [ 2103.850267][ T1308] ext4_sync_file+0x4f3/0x670 [ 2103.854950][ T1308] ? tsan.module_ctor+0x10/0x10 [ 2103.859808][ T1308] vfs_fsync_range+0x107/0x120 [ 2103.864576][ T1308] iomap_dio_complete+0x2d5/0x3c0 [ 2103.869609][ T1308] iomap_dio_rw+0x4e/0x70 [ 2103.873943][ T1308] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2103.879469][ T1308] ext4_file_write_iter+0xaa9/0x11f0 [ 2103.884849][ T1308] ? ext4_file_write_iter+0x4a1/0x11f0 [ 2103.890348][ T1308] ? _raw_spin_unlock_irqrestore+0x27/0x40 [ 2103.896199][ T1308] ? _raw_spin_lock_irqsave+0x38/0xa0 [ 2103.901580][ T1308] ? __list_del_entry_valid+0x54/0xc0 [ 2103.906976][ T1308] do_iter_readv_writev+0x2de/0x380 [ 2103.912263][ T1308] do_iter_write+0x192/0x5c0 [ 2103.916865][ T1308] ? splice_from_pipe_next+0x34f/0x3b0 [ 2103.922321][ T1308] ? kmalloc_array+0x2d/0x40 [ 2103.926918][ T1308] vfs_iter_write+0x4c/0x70 [ 2103.931429][ T1308] iter_file_splice_write+0x43a/0x790 [ 2103.936820][ T1308] ? splice_from_pipe+0xd0/0xd0 [ 2103.941682][ T1308] do_splice+0x9ca/0xd50 [ 2103.945963][ T1308] ? proc_fail_nth_write+0x127/0x150 [ 2103.951291][ T1308] ? vfs_write+0x61a/0x900 [ 2103.955727][ T1308] ? __fget_light+0x21b/0x260 [ 2103.960457][ T1308] __se_sys_splice+0x2bd/0x3a0 [ 2103.965225][ T1308] __x64_sys_splice+0x74/0x80 [ 2103.969903][ T1308] do_syscall_64+0x44/0xa0 [ 2103.974412][ T1308] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2103.980315][ T1308] RIP: 0033:0x7f704a8e28d9 [ 2103.984725][ T1308] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2104.004335][ T1308] RSP: 002b:00007f704865a188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2104.012842][ T1308] RAX: ffffffffffffffda RBX: 00007f704a9e6f60 RCX: 00007f704a8e28d9 [ 2104.020910][ T1308] RDX: 0000000000000006 RSI: 0000000000000000 RDI: 0000000000000004 [ 2104.028897][ T1308] RBP: 00007f704865a1d0 R08: 00000000088000d0 R09: 0000000000000000 [ 2104.036867][ T1308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 17:22:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x24, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:41 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xff0f}]) 17:22:41 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000007000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:41 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x19000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:41 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1a000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x25, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2104.044898][ T1308] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 [ 2104.070752][ T1312] loop5: detected capacity change from 0 to 4 [ 2104.099677][ T1312] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:41 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x20000}]) 17:22:41 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1b000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:41 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000001202000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2104.150906][ T1353] loop0: detected capacity change from 0 to 512 17:22:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x26, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2104.223821][ T1353] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2104.224610][ T1369] loop5: detected capacity change from 0 to 4 17:22:41 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000008000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2104.270289][ T1369] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2104.347823][ T1369] loop5: detected capacity change from 0 to 4 [ 2104.361336][ T1388] loop0: detected capacity change from 0 to 512 [ 2104.371033][ T1369] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2104.402890][ T1388] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) (fail_nth: 14) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1c000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:42 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x3b000}]) 17:22:42 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000001802000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:42 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000009000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x27, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2104.508278][ T1414] loop5: detected capacity change from 0 to 4 [ 2104.533385][ T1420] loop0: detected capacity change from 0 to 512 [ 2104.533457][ T1414] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2104.569180][ T1409] FAULT_INJECTION: forcing a failure. [ 2104.569180][ T1409] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2104.571195][ T1420] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2104.582323][ T1409] CPU: 1 PID: 1409 Comm: syz-executor.4 Tainted: G W 5.15.0-rc5-syzkaller #0 [ 2104.602769][ T1409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2104.612816][ T1409] Call Trace: [ 2104.616085][ T1409] dump_stack_lvl+0xd6/0x122 [ 2104.620723][ T1409] dump_stack+0x11/0x1b [ 2104.624882][ T1409] should_fail+0x23c/0x250 [ 2104.629293][ T1409] should_fail_usercopy+0x16/0x20 [ 2104.634311][ T1409] _copy_to_user+0x1c/0x90 [ 2104.638727][ T1409] simple_read_from_buffer+0xab/0x120 [ 2104.644098][ T1409] proc_fail_nth_read+0x10d/0x150 [ 2104.649126][ T1409] ? proc_fault_inject_write+0x230/0x230 [ 2104.654759][ T1409] vfs_read+0x1e6/0x750 [ 2104.658915][ T1409] ? __fget_light+0x21b/0x260 [ 2104.663586][ T1409] ? __cond_resched+0x11/0x40 [ 2104.668256][ T1409] ksys_read+0xd9/0x190 [ 2104.672403][ T1409] __x64_sys_read+0x3e/0x50 [ 2104.676910][ T1409] do_syscall_64+0x44/0xa0 [ 2104.681323][ T1409] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2104.687258][ T1409] RIP: 0033:0x7f704a89548c [ 2104.691671][ T1409] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 2104.711366][ T1409] RSP: 002b:00007f704865a170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 17:22:42 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000a000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2104.719847][ T1409] RAX: ffffffffffffffda RBX: 0000000000010000 RCX: 00007f704a89548c [ 2104.727815][ T1409] RDX: 000000000000000f RSI: 00007f704865a1e0 RDI: 0000000000000007 [ 2104.735826][ T1409] RBP: 00007f704865a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 2104.743802][ T1409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2104.751768][ T1409] R13: 00007ffec1f4364f R14: 00007f704865a300 R15: 0000000000022000 17:22:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x28, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x0) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1d000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:42 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000001c02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2104.782794][ T1414] loop5: detected capacity change from 0 to 4 [ 2104.790334][ T1414] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:42 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x3c000}]) [ 2104.856044][ T1450] loop0: detected capacity change from 0 to 512 [ 2104.863833][ T1455] loop5: detected capacity change from 0 to 4 [ 2104.893881][ T1455] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:42 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000002002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:42 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000b000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2104.906421][ T1450] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2104.966782][ T1471] loop5: detected capacity change from 0 to 4 [ 2104.975319][ T1471] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1e000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2105.030820][ T1471] loop5: detected capacity change from 0 to 4 [ 2105.040488][ T1471] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2105.049947][ T1484] loop0: detected capacity change from 0 to 512 17:22:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x29, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:42 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000002502000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:42 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x80000}]) [ 2105.088729][ T1484] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:42 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000c000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2105.148811][ T1496] loop5: detected capacity change from 0 to 4 [ 2105.183377][ T1496] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:42 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000002602000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2105.278181][ T1511] loop0: detected capacity change from 0 to 512 [ 2105.350835][ T1511] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2105.361945][ T1520] loop5: detected capacity change from 0 to 4 [ 2105.371028][ T1520] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:43 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x8800010, 0x0) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:43 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000f000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:43 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000053102000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:43 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x1f000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:43 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2a, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:43 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x100000}]) [ 2105.733170][ T1541] loop0: detected capacity change from 0 to 512 [ 2105.737593][ T1545] loop5: detected capacity change from 0 to 4 [ 2105.754217][ T1545] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2105.789380][ T1541] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2105.814388][ C0] scsi_io_completion_action: 15 callbacks suppressed [ 2105.814419][ C0] sd 0:0:1:0: tag#1548 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2105.830964][ C0] sd 0:0:1:0: tag#1548 CDB: opcode=0xe5 (vendor) [ 2105.837332][ C0] sd 0:0:1:0: tag#1548 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2105.841579][ C1] sd 0:0:1:0: tag#1550 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2105.846369][ C0] sd 0:0:1:0: tag#1548 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2105.856179][ C1] sd 0:0:1:0: tag#1550 CDB: opcode=0xe5 (vendor) [ 2105.856195][ C1] sd 0:0:1:0: tag#1550 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2105.865192][ C0] sd 0:0:1:0: tag#1548 CDB[20]: ba 17:22:43 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000010000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2105.871491][ C1] sd 0:0:1:0: tag#1550 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2105.894635][ C1] sd 0:0:1:0: tag#1550 CDB[20]: ba [ 2105.918732][ T1545] loop5: detected capacity change from 0 to 4 17:22:43 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x20000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:43 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000003f02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:43 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2b, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2105.964597][ T1545] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:43 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xb00300}]) [ 2106.024297][ T1578] loop5: detected capacity change from 0 to 4 [ 2106.028809][ T1580] loop0: detected capacity change from 0 to 512 [ 2106.057231][ T1578] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2106.080018][ T1580] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2106.090940][ C1] sd 0:0:1:0: tag#1582 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2106.100895][ C1] sd 0:0:1:0: tag#1582 CDB: opcode=0xe5 (vendor) [ 2106.107249][ C1] sd 0:0:1:0: tag#1582 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2106.116308][ C1] sd 0:0:1:0: tag#1582 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 17:22:43 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000011000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2106.125358][ C1] sd 0:0:1:0: tag#1582 CDB[20]: ba [ 2106.174379][ C0] sd 0:0:1:0: tag#1597 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2106.184246][ C0] sd 0:0:1:0: tag#1597 CDB: opcode=0xe5 (vendor) [ 2106.190581][ C0] sd 0:0:1:0: tag#1597 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2106.199625][ C0] sd 0:0:1:0: tag#1597 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2106.208677][ C0] sd 0:0:1:0: tag#1597 CDB[20]: ba [ 2106.241721][ T1578] loop5: detected capacity change from 0 to 4 [ 2106.261144][ T1578] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2106.282837][ T1605] loop0: detected capacity change from 0 to 512 [ 2106.319474][ T1605] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:44 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0xffffffffffffffff, 0x0) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:44 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x21000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:44 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xc00300}]) 17:22:44 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000004002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:44 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000fe000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:44 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2c, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2106.619219][ T1628] loop5: detected capacity change from 0 to 4 [ 2106.621396][ T1627] loop0: detected capacity change from 0 to 512 [ 2106.659843][ T1628] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2106.667482][ T1627] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2106.695593][ C1] sd 0:0:1:0: tag#1597 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2106.705464][ C1] sd 0:0:1:0: tag#1597 CDB: opcode=0xe5 (vendor) [ 2106.711795][ C1] sd 0:0:1:0: tag#1597 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2106.720840][ C1] sd 0:0:1:0: tag#1597 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2106.729872][ C1] sd 0:0:1:0: tag#1597 CDB[20]: ba 17:22:44 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000800000000e010000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2106.766527][ C0] sd 0:0:1:0: tag#1598 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2106.776405][ C0] sd 0:0:1:0: tag#1598 CDB: opcode=0xe5 (vendor) [ 2106.782758][ C0] sd 0:0:1:0: tag#1598 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2106.791784][ C0] sd 0:0:1:0: tag#1598 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2106.800847][ C0] sd 0:0:1:0: tag#1598 CDB[20]: ba 17:22:44 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x22000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2106.823857][ T1628] loop5: detected capacity change from 0 to 4 [ 2106.838846][ T1628] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:44 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800008004002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2106.870090][ T1658] loop0: detected capacity change from 0 to 512 17:22:44 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xf0ff1f}]) [ 2106.955170][ T1658] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2106.984929][ T1669] loop5: detected capacity change from 0 to 4 [ 2107.005432][ C1] sd 0:0:1:0: tag#1594 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2107.015288][ C1] sd 0:0:1:0: tag#1594 CDB: opcode=0xe5 (vendor) [ 2107.021627][ C1] sd 0:0:1:0: tag#1594 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2107.030669][ C1] sd 0:0:1:0: tag#1594 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2107.039697][ C1] sd 0:0:1:0: tag#1594 CDB[20]: ba 17:22:44 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000feff0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:44 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x23000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2107.101331][ T1669] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2107.155063][ T1669] loop5: detected capacity change from 0 to 4 [ 2107.166053][ T1669] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2107.184061][ T1693] loop0: detected capacity change from 0 to 512 [ 2107.210371][ T1693] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2107.241415][ C1] sd 0:0:1:0: tag#1571 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2107.251297][ C1] sd 0:0:1:0: tag#1571 CDB: opcode=0xe5 (vendor) [ 2107.257654][ C1] sd 0:0:1:0: tag#1571 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2107.266724][ C1] sd 0:0:1:0: tag#1571 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2107.275811][ C1] sd 0:0:1:0: tag#1571 CDB[20]: ba 17:22:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x2) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:45 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1000000}]) 17:22:45 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000004802000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:45 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000feffffff660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2d, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x24000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2107.512955][ T1714] loop0: detected capacity change from 0 to 512 [ 2107.525479][ T1716] loop5: detected capacity change from 0 to 4 [ 2107.540815][ T1714] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2107.558782][ T1716] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2107.588530][ C1] sd 0:0:1:0: tag#1599 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2107.598423][ C1] sd 0:0:1:0: tag#1599 CDB: opcode=0xe5 (vendor) [ 2107.602574][ C0] sd 0:0:1:0: tag#1536 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2107.604769][ C1] sd 0:0:1:0: tag#1599 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2107.614563][ C0] sd 0:0:1:0: tag#1536 CDB: opcode=0xe5 (vendor) [ 2107.623566][ C1] sd 0:0:1:0: tag#1599 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 17:22:45 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060000000a0000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2107.629868][ C0] sd 0:0:1:0: tag#1536 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2107.638873][ C1] sd 0:0:1:0: tag#1599 CDB[20]: ba [ 2107.647871][ C0] sd 0:0:1:0: tag#1536 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2107.662008][ C0] sd 0:0:1:0: tag#1536 CDB[20]: ba 17:22:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x25000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:45 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x2000000}]) 17:22:45 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000004c02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2107.714276][ T1716] loop5: detected capacity change from 0 to 4 [ 2107.730294][ T1716] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2107.749729][ T1740] loop0: detected capacity change from 0 to 512 17:22:45 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000250000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2107.786487][ T1740] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2107.825087][ T1751] loop5: detected capacity change from 0 to 4 17:22:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2e, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2107.845643][ T1751] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2107.893828][ T1751] loop5: detected capacity change from 0 to 4 [ 2107.905513][ T1751] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2107.928267][ T1771] loop0: detected capacity change from 0 to 512 [ 2107.987440][ T1771] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x3) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:45 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000006802000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x26000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:45 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x2040000}]) 17:22:45 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060000002e0000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2f, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2108.386199][ T1791] loop0: detected capacity change from 0 to 512 [ 2108.390072][ T1790] loop5: detected capacity change from 0 to 4 [ 2108.416433][ T1790] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:46 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060000002f0000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2108.436127][ T1791] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2108.494070][ T1790] loop5: detected capacity change from 0 to 4 [ 2108.510352][ T1790] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:46 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000006c02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2108.538101][ T1817] loop0: detected capacity change from 0 to 512 [ 2108.579366][ T1817] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2108.606961][ T1828] loop5: detected capacity change from 0 to 4 17:22:46 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006020000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:46 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x3000000}]) 17:22:46 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x30, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:46 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x27000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2108.627707][ T1828] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2108.697920][ T1828] loop5: detected capacity change from 0 to 4 [ 2108.705857][ T1828] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2108.734987][ T1846] loop0: detected capacity change from 0 to 512 [ 2108.776555][ T1846] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x4) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:46 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000007402000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:46 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006030000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:46 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x28000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:46 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x31, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:46 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x4000000}]) [ 2109.304342][ T1870] loop0: detected capacity change from 0 to 512 [ 2109.308475][ T1872] loop5: detected capacity change from 0 to 4 [ 2109.343803][ T1870] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:46 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006040000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2109.354930][ T1872] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:47 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x32, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:47 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006050000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:47 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x5000000}]) [ 2109.433754][ T1872] loop5: detected capacity change from 0 to 4 [ 2109.441701][ T1872] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2109.457329][ T1889] loop0: detected capacity change from 0 to 512 [ 2109.470896][ T1889] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:47 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000007a02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:47 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x29000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2109.556565][ T1912] loop5: detected capacity change from 0 to 4 [ 2109.586966][ T1912] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2109.600790][ T1920] loop0: detected capacity change from 0 to 512 [ 2109.633703][ T1920] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2109.653042][ T1912] loop5: detected capacity change from 0 to 4 [ 2109.661700][ T1912] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:47 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x5) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:47 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006060000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:47 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000048002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:47 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x33, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:47 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x6000000}]) 17:22:47 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2a000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2110.186190][ T1951] loop0: detected capacity change from 0 to 512 [ 2110.194690][ T1952] loop5: detected capacity change from 0 to 4 17:22:47 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006070000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2110.237013][ T1952] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2110.244879][ T1951] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2110.329376][ T1952] loop5: detected capacity change from 0 to 4 [ 2110.339208][ T1952] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:48 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x6040000}]) 17:22:48 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x34, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:48 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180ffffff8502000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2110.400281][ T1982] loop0: detected capacity change from 0 to 512 17:22:48 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2b000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:48 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006080000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2110.463554][ T1982] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2110.486287][ T1999] loop5: detected capacity change from 0 to 4 [ 2110.496012][ T1999] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2110.533190][ T1999] loop5: detected capacity change from 0 to 4 [ 2110.544569][ T1999] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2110.592576][ T2016] loop0: detected capacity change from 0 to 512 [ 2110.612177][ T2016] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:48 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x6) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:48 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180ffffff9702000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:48 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x7000000}]) 17:22:48 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006090000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:48 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x35, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:48 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2c000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2111.041769][ T2041] loop0: detected capacity change from 0 to 512 [ 2111.046671][ T2047] loop5: detected capacity change from 0 to 4 [ 2111.057478][ T2047] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:48 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180f96d09b802000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2111.089623][ T2041] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2111.128888][ C1] scsi_io_completion_action: 14 callbacks suppressed [ 2111.128918][ C1] sd 0:0:1:0: tag#1558 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2111.141032][ C0] sd 0:0:1:0: tag#1559 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2111.145454][ C1] sd 0:0:1:0: tag#1558 CDB: opcode=0xe5 (vendor) [ 2111.155264][ C0] sd 0:0:1:0: tag#1559 CDB: opcode=0xe5 (vendor) [ 2111.161576][ C1] sd 0:0:1:0: tag#1558 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2111.167899][ C0] sd 0:0:1:0: tag#1559 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2111.176919][ C1] sd 0:0:1:0: tag#1558 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2111.185930][ C0] sd 0:0:1:0: tag#1559 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2111.194930][ C1] sd 0:0:1:0: tag#1558 CDB[20]: ba [ 2111.203951][ C0] sd 0:0:1:0: tag#1559 CDB[20]: ba 17:22:48 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060a0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:48 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fffffff602000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:48 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2d000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2111.245215][ T2062] loop5: detected capacity change from 0 to 4 [ 2111.278765][ T2062] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:48 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x36, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:49 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x8000000}]) [ 2111.356370][ T2078] loop5: detected capacity change from 0 to 4 [ 2111.373347][ T2078] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2111.387721][ T2081] loop0: detected capacity change from 0 to 512 [ 2111.428808][ C0] sd 0:0:1:0: tag#1542 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2111.438691][ C0] sd 0:0:1:0: tag#1542 CDB: opcode=0xe5 (vendor) [ 2111.445063][ C0] sd 0:0:1:0: tag#1542 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2111.454213][ C0] sd 0:0:1:0: tag#1542 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2111.454905][ T2081] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2111.463272][ C0] sd 0:0:1:0: tag#1542 CDB[20]: ba [ 2111.509736][ C0] sd 0:0:1:0: tag#1551 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2111.519602][ C0] sd 0:0:1:0: tag#1551 CDB: opcode=0xe5 (vendor) [ 2111.525964][ C0] sd 0:0:1:0: tag#1551 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2111.535019][ C0] sd 0:0:1:0: tag#1551 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2111.544065][ C0] sd 0:0:1:0: tag#1551 CDB[20]: ba 17:22:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x7) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:49 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180b8096df902000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:49 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060b0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:49 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2e000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:49 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x37, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:49 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x9000000}]) 17:22:49 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060c0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2111.880941][ T2107] loop0: detected capacity change from 0 to 512 [ 2111.893413][ T2107] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2111.911966][ T2118] loop5: detected capacity change from 0 to 4 [ 2111.947627][ T2118] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2111.972940][ C0] sd 0:0:1:0: tag#1550 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2111.980904][ C1] sd 0:0:1:0: tag#1552 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2111.982804][ C0] sd 0:0:1:0: tag#1550 CDB: opcode=0xe5 (vendor) [ 2111.992590][ C1] sd 0:0:1:0: tag#1552 CDB: opcode=0xe5 (vendor) [ 2111.992606][ C1] sd 0:0:1:0: tag#1552 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2111.998914][ C0] sd 0:0:1:0: tag#1550 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2112.005250][ C1] sd 0:0:1:0: tag#1552 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2112.014268][ C0] sd 0:0:1:0: tag#1550 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2112.023273][ C1] sd 0:0:1:0: tag#1552 CDB[20]: ba [ 2112.032305][ C0] sd 0:0:1:0: tag#1550 CDB[20]: ba 17:22:49 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x38, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:49 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x2f000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2112.119131][ T2118] loop5: detected capacity change from 0 to 4 [ 2112.135595][ T2142] loop0: detected capacity change from 0 to 512 [ 2112.148377][ T2118] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:49 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fffffdfc02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:49 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xa000000}]) [ 2112.160666][ T2142] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:49 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060d0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2112.202473][ C1] sd 0:0:1:0: tag#1566 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2112.212350][ C1] sd 0:0:1:0: tag#1566 CDB: opcode=0xe5 (vendor) [ 2112.218678][ C1] sd 0:0:1:0: tag#1566 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2112.227735][ C1] sd 0:0:1:0: tag#1566 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2112.237136][ C1] sd 0:0:1:0: tag#1566 CDB[20]: ba [ 2112.262148][ C0] sd 0:0:1:0: tag#1581 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2112.272007][ C0] sd 0:0:1:0: tag#1581 CDB: opcode=0xe5 (vendor) [ 2112.278339][ C0] sd 0:0:1:0: tag#1581 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2112.287387][ C0] sd 0:0:1:0: tag#1581 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2112.296424][ C0] sd 0:0:1:0: tag#1581 CDB[20]: ba [ 2112.312312][ T2159] loop5: detected capacity change from 0 to 4 [ 2112.321258][ T2159] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2112.350839][ T2168] loop0: detected capacity change from 0 to 512 [ 2112.371716][ T2159] loop5: detected capacity change from 0 to 4 [ 2112.378640][ T2159] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2112.386584][ T2168] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:50 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x39, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x8) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:50 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fffffdfd02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:50 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x30000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:50 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060e0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:50 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xb000000}]) [ 2112.782807][ T2194] loop5: detected capacity change from 0 to 4 [ 2112.785976][ T2192] loop0: detected capacity change from 0 to 512 [ 2112.822858][ T2194] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2112.830405][ T2192] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:50 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000060f0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2112.880929][ C1] sd 0:0:1:0: tag#1572 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2112.890803][ C1] sd 0:0:1:0: tag#1572 CDB: opcode=0xe5 (vendor) [ 2112.897169][ C1] sd 0:0:1:0: tag#1572 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2112.906227][ C1] sd 0:0:1:0: tag#1572 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2112.915274][ C1] sd 0:0:1:0: tag#1572 CDB[20]: ba [ 2112.933388][ C0] sd 0:0:1:0: tag#1577 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2112.943241][ C0] sd 0:0:1:0: tag#1577 CDB: opcode=0xe5 (vendor) [ 2112.949569][ C0] sd 0:0:1:0: tag#1577 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2112.955723][ T2194] loop5: detected capacity change from 0 to 4 [ 2112.958620][ C0] sd 0:0:1:0: tag#1577 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2112.967647][ T2194] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:50 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x31000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2112.973672][ C0] sd 0:0:1:0: tag#1577 CDB[20]: ba 17:22:50 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fffffffd02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:50 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xc000000}]) [ 2113.053796][ T2230] loop0: detected capacity change from 0 to 512 [ 2113.075032][ T2230] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2113.081371][ T2232] loop5: detected capacity change from 0 to 4 17:22:50 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006100000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2113.116809][ T2232] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:50 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x32000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:50 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x3a, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2113.178122][ T2232] loop5: detected capacity change from 0 to 4 [ 2113.192758][ T2232] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2113.200249][ T2255] loop0: detected capacity change from 0 to 512 [ 2113.247934][ T2255] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:51 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x9) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:51 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fffffffe02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:51 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xd000000}]) 17:22:51 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006110000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:51 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x33000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:51 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x3b, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2113.664656][ T2280] loop5: detected capacity change from 0 to 4 [ 2113.681985][ T2288] loop0: detected capacity change from 0 to 512 [ 2113.691985][ T2280] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2113.719656][ T2288] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:51 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006120000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2113.765349][ T2280] loop5: detected capacity change from 0 to 4 [ 2113.787112][ T2280] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:51 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x34000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:51 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xe000000}]) [ 2113.851781][ T2309] loop0: detected capacity change from 0 to 512 [ 2113.888003][ T2309] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:51 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fcfdffff02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:51 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x3c, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:51 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006180000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2113.950729][ T2328] loop5: detected capacity change from 0 to 4 [ 2113.976667][ T2328] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2114.023018][ T2328] loop5: detected capacity change from 0 to 4 [ 2114.037485][ T2328] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2114.043879][ T2347] loop0: detected capacity change from 0 to 512 [ 2114.071253][ T2347] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:52 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0xc) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:52 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x35000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:52 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fdfdffff02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:52 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000061a0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x3d, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:52 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xf000000}]) [ 2114.551468][ T2369] loop0: detected capacity change from 0 to 512 [ 2114.557556][ T2371] loop5: detected capacity change from 0 to 4 [ 2114.569371][ T2369] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:52 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006220000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2114.602496][ T2371] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:52 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x350b0000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2114.678593][ T2371] loop5: detected capacity change from 0 to 4 [ 2114.688661][ T2371] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2114.703254][ T2396] loop0: detected capacity change from 0 to 512 17:22:52 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x10000000}]) 17:22:52 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f0000000000000000018085ffffff02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2114.730851][ T2396] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:52 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006250000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2114.786306][ T2410] loop5: detected capacity change from 0 to 4 [ 2114.794654][ T2410] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x3e, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2114.836845][ T2410] loop5: detected capacity change from 0 to 4 [ 2114.851400][ T2410] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2114.908583][ T2431] loop0: detected capacity change from 0 to 512 [ 2114.930895][ T2431] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:53 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f0000000000000000018097ffffff02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:53 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x11000000}]) 17:22:53 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x36000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:53 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0xd) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:53 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000062e0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2115.437002][ T2455] loop0: detected capacity change from 0 to 512 [ 2115.445287][ T2456] loop5: detected capacity change from 0 to 4 [ 2115.467923][ T2456] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:53 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180f6ffffff02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2115.485973][ T2455] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:53 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006320000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:53 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x12000000}]) [ 2115.580081][ T2477] loop5: detected capacity change from 0 to 4 [ 2115.597934][ T2477] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2115.631107][ T2484] loop0: detected capacity change from 0 to 512 [ 2115.641688][ T2477] loop5: detected capacity change from 0 to 4 [ 2115.666469][ T2484] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:53 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x37000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:53 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180fdffffff02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2115.679374][ T2477] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:53 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006350000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:53 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x500, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2115.778814][ T2507] loop5: detected capacity change from 0 to 4 [ 2115.801301][ T2517] loop0: detected capacity change from 0 to 512 [ 2115.808760][ T2507] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:53 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x13000000}]) [ 2115.838166][ T2517] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2115.868088][ T2507] loop5: detected capacity change from 0 to 4 17:22:53 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006430000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2115.882338][ T2507] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2115.983681][ T2542] loop0: detected capacity change from 0 to 512 [ 2115.998234][ T2542] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0xe) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:53 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x38000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:53 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x600, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:53 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180feffffff02000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:53 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006440000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:53 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x14000000}]) [ 2116.304360][ T2558] loop0: detected capacity change from 0 to 512 [ 2116.306247][ T2560] loop5: detected capacity change from 0 to 4 [ 2116.341893][ T2560] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2116.349158][ T2558] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2116.392035][ T2560] loop5: detected capacity change from 0 to 4 [ 2116.422511][ C0] scsi_io_completion_action: 15 callbacks suppressed [ 2116.422542][ C0] sd 0:0:1:0: tag#1584 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2116.439182][ C0] sd 0:0:1:0: tag#1584 CDB: opcode=0xe5 (vendor) [ 2116.445638][ C0] sd 0:0:1:0: tag#1584 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2116.454680][ C0] sd 0:0:1:0: tag#1584 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2116.463735][ C0] sd 0:0:1:0: tag#1584 CDB[20]: ba [ 2116.476264][ C1] sd 0:0:1:0: tag#1585 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2116.486137][ C1] sd 0:0:1:0: tag#1585 CDB: opcode=0xe5 (vendor) 17:22:54 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006480000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2116.492502][ C1] sd 0:0:1:0: tag#1585 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2116.501550][ C1] sd 0:0:1:0: tag#1585 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2116.510608][ C1] sd 0:0:1:0: tag#1585 CDB[20]: ba [ 2116.520863][ T2560] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:54 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000200000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:54 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x700, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:54 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x15000000}]) 17:22:54 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x39000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2116.655679][ T2590] loop0: detected capacity change from 0 to 512 [ 2116.692065][ T2590] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:54 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000064c0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2116.719980][ T2604] loop5: detected capacity change from 0 to 4 [ 2116.733391][ T2604] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2116.821931][ T2623] loop0: detected capacity change from 0 to 512 [ 2116.828577][ C0] sd 0:0:1:0: tag#1555 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2116.830136][ C1] sd 0:0:1:0: tag#1556 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2116.838416][ C0] sd 0:0:1:0: tag#1555 CDB: opcode=0xe5 (vendor) [ 2116.848208][ C1] sd 0:0:1:0: tag#1556 CDB: opcode=0xe5 (vendor) [ 2116.854601][ C0] sd 0:0:1:0: tag#1555 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2116.860911][ C1] sd 0:0:1:0: tag#1556 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2116.869904][ C0] sd 0:0:1:0: tag#1555 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2116.878920][ C1] sd 0:0:1:0: tag#1556 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2116.887920][ C0] sd 0:0:1:0: tag#1555 CDB[20]: ba [ 2116.896920][ C1] sd 0:0:1:0: tag#1556 CDB[20]: ba [ 2116.968854][ T2623] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:54 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0xf) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:54 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000000001000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:54 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x900, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:54 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x16000000}]) 17:22:54 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3a000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:54 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006600000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2117.191446][ T2646] loop5: detected capacity change from 0 to 4 [ 2117.193958][ T2647] loop0: detected capacity change from 0 to 512 [ 2117.214742][ T2646] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2117.243656][ T2647] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2117.261821][ T2646] loop5: detected capacity change from 0 to 4 [ 2117.273400][ T2646] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2117.283332][ C1] sd 0:0:1:0: tag#1596 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 17:22:54 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006680000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2117.293175][ C1] sd 0:0:1:0: tag#1596 CDB: opcode=0xe5 (vendor) [ 2117.299504][ C1] sd 0:0:1:0: tag#1596 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2117.308559][ C1] sd 0:0:1:0: tag#1596 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2117.314774][ C0] sd 0:0:1:0: tag#1597 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2117.317612][ C1] sd 0:0:1:0: tag#1596 CDB[20]: ba [ 2117.327411][ C0] sd 0:0:1:0: tag#1597 CDB: opcode=0xe5 (vendor) 17:22:55 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800002000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2117.338805][ C0] sd 0:0:1:0: tag#1597 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2117.347867][ C0] sd 0:0:1:0: tag#1597 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2117.356917][ C0] sd 0:0:1:0: tag#1597 CDB[20]: ba 17:22:55 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3b000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:55 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x17000000}]) [ 2117.419365][ T2676] loop5: detected capacity change from 0 to 4 [ 2117.432391][ T2680] loop0: detected capacity change from 0 to 512 [ 2117.450002][ T2676] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xa00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:55 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000066c0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2117.475516][ T2676] loop5: detected capacity change from 0 to 4 [ 2117.483282][ T2680] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2117.500387][ T2676] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2117.547416][ C0] sd 0:0:1:0: tag#1569 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2117.557300][ C0] sd 0:0:1:0: tag#1569 CDB: opcode=0xe5 (vendor) [ 2117.563671][ C0] sd 0:0:1:0: tag#1569 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2117.572703][ C0] sd 0:0:1:0: tag#1569 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2117.581774][ C0] sd 0:0:1:0: tag#1569 CDB[20]: ba [ 2117.636209][ C1] sd 0:0:1:0: tag#1589 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2117.646059][ C1] sd 0:0:1:0: tag#1589 CDB: opcode=0xe5 (vendor) [ 2117.652399][ C1] sd 0:0:1:0: tag#1589 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2117.661485][ C1] sd 0:0:1:0: tag#1589 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2117.670515][ C1] sd 0:0:1:0: tag#1589 CDB[20]: ba [ 2117.677160][ T2707] loop0: detected capacity change from 0 to 512 [ 2117.704484][ T2707] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:55 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x10) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:55 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800003000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:55 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3c000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:55 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x1ffff000}]) 17:22:55 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006740000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xb00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2118.051648][ T2726] loop5: detected capacity change from 0 to 4 [ 2118.058415][ T2727] loop0: detected capacity change from 0 to 512 [ 2118.085711][ T2726] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:55 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000067a0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2118.100236][ T2727] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2118.140534][ C1] sd 0:0:1:0: tag#1544 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2118.150207][ C0] sd 0:0:1:0: tag#1545 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2118.150397][ C1] sd 0:0:1:0: tag#1544 CDB: opcode=0xe5 (vendor) [ 2118.160157][ C0] sd 0:0:1:0: tag#1545 CDB: opcode=0xe5 (vendor) [ 2118.166455][ C1] sd 0:0:1:0: tag#1544 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2118.172803][ C0] sd 0:0:1:0: tag#1545 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2118.181811][ C1] sd 0:0:1:0: tag#1544 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2118.190814][ C0] sd 0:0:1:0: tag#1545 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2118.199804][ C1] sd 0:0:1:0: tag#1544 CDB[20]: ba [ 2118.208822][ C0] sd 0:0:1:0: tag#1545 CDB[20]: ba 17:22:55 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3d000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2118.278385][ T2726] loop5: detected capacity change from 0 to 4 [ 2118.288343][ T2726] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2118.317125][ T2757] loop0: detected capacity change from 0 to 512 17:22:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xb35, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:55 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800004000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:56 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006b60000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2118.336695][ T2757] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:56 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x20000000}]) [ 2118.393355][ T2768] loop5: detected capacity change from 0 to 4 [ 2118.420031][ T2768] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2118.463895][ T2780] loop0: detected capacity change from 0 to 512 [ 2118.490820][ T2780] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2118.521449][ T2768] loop5: detected capacity change from 0 to 4 [ 2118.537842][ T2768] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:56 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x12) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:56 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006fe0000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:56 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3e000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:56 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x21000000}]) 17:22:56 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xc00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:56 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800005000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2118.924756][ T2811] loop0: detected capacity change from 0 to 512 [ 2118.937099][ T2816] loop5: detected capacity change from 0 to 4 [ 2118.953671][ T2811] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:56 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006460100660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2118.990689][ T2816] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:56 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xd00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2119.074822][ T2816] loop5: detected capacity change from 0 to 4 [ 2119.084945][ T2816] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2119.107083][ T2840] loop0: detected capacity change from 0 to 512 17:22:56 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x22000000}]) 17:22:56 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800006000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:56 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x3f000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2119.141370][ T2840] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:56 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006ac0100660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2119.210924][ T2852] loop5: detected capacity change from 0 to 4 [ 2119.269774][ T2852] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2119.339195][ T2870] loop0: detected capacity change from 0 to 512 [ 2119.362625][ T2870] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:57 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x22) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:57 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800007000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:57 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x40000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:57 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x3f000000}]) 17:22:57 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006ad0100660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:57 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xe00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2119.776492][ T2890] loop0: detected capacity change from 0 to 512 [ 2119.792130][ T2896] loop5: detected capacity change from 0 to 4 [ 2119.814946][ T2896] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:57 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006c20100660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2119.831422][ T2890] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2119.860901][ T2896] loop5: detected capacity change from 0 to 4 [ 2119.869325][ T2896] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2119.900244][ T1126] ================================================================== [ 2119.908343][ T1126] BUG: KCSAN: data-race in __add_to_page_cache_locked / invalidate_bdev [ 2119.916674][ T1126] [ 2119.918991][ T1126] write to 0xffff88813c934e28 of 8 bytes by task 2905 on cpu 0: [ 2119.926617][ T1126] __add_to_page_cache_locked+0x276/0x4f0 [ 2119.932340][ T1126] add_to_page_cache_lru+0xa0/0x1b0 [ 2119.937537][ T1126] page_cache_ra_unbounded+0x274/0x430 [ 2119.942989][ T1126] force_page_cache_ra+0x256/0x290 [ 2119.948097][ T1126] page_cache_sync_ra+0xcc/0xe0 [ 2119.952941][ T1126] filemap_read+0x3ad/0x1220 [ 2119.957531][ T1126] generic_file_read_iter+0x75/0x2c0 [ 2119.962816][ T1126] blkdev_read_iter+0xb9/0xf0 [ 2119.967489][ T1126] vfs_read+0x66c/0x750 [ 2119.971640][ T1126] ksys_read+0xd9/0x190 [ 2119.975790][ T1126] __x64_sys_read+0x3e/0x50 [ 2119.980285][ T1126] do_syscall_64+0x44/0xa0 [ 2119.984689][ T1126] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2119.990578][ T1126] [ 2119.992886][ T1126] read to 0xffff88813c934e28 of 8 bytes by task 1126 on cpu 1: [ 2120.000421][ T1126] invalidate_bdev+0x31/0x80 [ 2120.005008][ T1126] ext4_put_super+0x620/0x910 [ 2120.009680][ T1126] generic_shutdown_super+0xe1/0x230 [ 2120.014961][ T1126] kill_block_super+0x4a/0x90 [ 2120.019629][ T1126] deactivate_locked_super+0x65/0xd0 [ 2120.024910][ T1126] deactivate_super+0x85/0x90 [ 2120.029582][ T1126] cleanup_mnt+0x267/0x2d0 [ 2120.033992][ T1126] __cleanup_mnt+0x15/0x20 [ 2120.038410][ T1126] task_work_run+0xae/0x130 [ 2120.042909][ T1126] exit_to_user_mode_prepare+0x156/0x190 17:22:57 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xfbffffff, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:57 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0xf00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2120.048631][ T1126] syscall_exit_to_user_mode+0x20/0x40 [ 2120.054082][ T1126] do_syscall_64+0x50/0xa0 [ 2120.058496][ T1126] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2120.064398][ T1126] [ 2120.066714][ T1126] value changed: 0x0000000000000007 -> 0x0000000000000008 [ 2120.073802][ T1126] [ 2120.076109][ T1126] Reported by Kernel Concurrency Sanitizer on: [ 2120.082242][ T1126] CPU: 1 PID: 1126 Comm: syz-executor.0 Tainted: G W 5.15.0-rc5-syzkaller #0 17:22:57 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800008000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2120.092295][ T1126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2120.102348][ T1126] ================================================================== 17:22:57 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0x40000000}]) [ 2120.178854][ T2927] loop5: detected capacity change from 0 to 4 [ 2120.217759][ T2934] loop0: detected capacity change from 0 to 512 [ 2120.230990][ T2927] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2120.282165][ T2927] loop5: detected capacity change from 0 to 4 [ 2120.288472][ T2934] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2120.299768][ T2927] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:57 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800009000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2120.412400][ T2954] loop5: detected capacity change from 0 to 4 [ 2120.421615][ T2954] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2120.455537][ T2954] loop5: detected capacity change from 0 to 4 [ 2120.462249][ T2954] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:58 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x94) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:58 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006fc0100660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:58 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xfeffffff, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:58 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1100, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:58 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000a000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:58 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xe4ffffff}]) [ 2120.661238][ T2976] loop5: detected capacity change from 0 to 4 [ 2120.664361][ T2979] loop0: detected capacity change from 0 to 512 [ 2120.702198][ T2976] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2120.710096][ T2979] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:58 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006040200660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2120.787426][ T2976] loop5: detected capacity change from 0 to 4 [ 2120.795477][ T2976] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:58 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000b000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:58 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xf4ffffff}]) [ 2120.864654][ T3009] loop0: detected capacity change from 0 to 512 [ 2120.893351][ T3009] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:58 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xff0f0000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:58 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1200, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:58 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006190200660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2120.916584][ T3018] loop5: detected capacity change from 0 to 4 [ 2120.954735][ T3018] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2121.016143][ T3018] loop5: detected capacity change from 0 to 4 [ 2121.025677][ T3018] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2121.037895][ T3033] loop0: detected capacity change from 0 to 512 [ 2121.073793][ T3033] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:59 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x96) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:22:59 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xfbffffff}]) 17:22:59 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000c000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:59 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000062d0200660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:59 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xff7f0000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:59 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2121.534379][ T3061] loop5: detected capacity change from 0 to 4 [ 2121.543815][ T3063] loop0: detected capacity change from 0 to 512 [ 2121.556782][ T3061] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2121.577480][ T3063] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:59 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="2000000080000000064e0200660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2121.616044][ T3061] loop5: detected capacity change from 0 to 4 [ 2121.641592][ C0] scsi_io_completion_action: 14 callbacks suppressed [ 2121.641619][ C0] sd 0:0:1:0: tag#1554 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2121.642022][ C1] sd 0:0:1:0: tag#1555 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2121.648341][ C0] sd 0:0:1:0: tag#1554 CDB: opcode=0xe5 (vendor) [ 2121.658159][ C1] sd 0:0:1:0: tag#1555 CDB: opcode=0xe5 (vendor) [ 2121.667942][ C0] sd 0:0:1:0: tag#1554 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2121.674253][ C1] sd 0:0:1:0: tag#1555 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2121.680558][ C0] sd 0:0:1:0: tag#1554 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2121.689561][ C1] sd 0:0:1:0: tag#1555 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2121.698547][ C0] sd 0:0:1:0: tag#1554 CDB[20]: ba [ 2121.721717][ C1] sd 0:0:1:0: tag#1555 CDB[20]: ba 17:22:59 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000d000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2121.786693][ T3061] EXT4-fs (loop5): Can't read superblock on 2nd try 17:22:59 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xffffff07, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:59 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xfeffffff}]) [ 2121.836868][ T3091] loop0: detected capacity change from 0 to 512 [ 2121.866572][ T3091] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:59 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1400, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:59 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006520200660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2121.909305][ T3103] loop5: detected capacity change from 0 to 4 [ 2121.925915][ T3103] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2121.998101][ C0] sd 0:0:1:0: tag#1565 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2122.007984][ C0] sd 0:0:1:0: tag#1565 CDB: opcode=0xe5 (vendor) [ 2122.014358][ C0] sd 0:0:1:0: tag#1565 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2122.023402][ C0] sd 0:0:1:0: tag#1565 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2122.032462][ C0] sd 0:0:1:0: tag#1565 CDB[20]: ba [ 2122.050177][ T3103] loop5: detected capacity change from 0 to 4 [ 2122.072449][ T3103] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2122.086414][ T3123] loop0: detected capacity change from 0 to 512 [ 2122.096428][ C0] sd 0:0:1:0: tag#1560 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2122.106269][ C0] sd 0:0:1:0: tag#1560 CDB: opcode=0xe5 (vendor) [ 2122.112613][ C0] sd 0:0:1:0: tag#1560 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2122.121673][ C0] sd 0:0:1:0: tag#1560 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2122.130736][ C0] sd 0:0:1:0: tag#1560 CDB[20]: ba [ 2122.166925][ T3123] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:22:59 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xfffffffb, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:59 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1500, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:22:59 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180000e000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:22:59 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xff010000}]) 17:22:59 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006530200660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:22:59 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x98) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) [ 2122.410244][ T3148] loop0: detected capacity change from 0 to 512 [ 2122.421315][ T3154] loop5: detected capacity change from 0 to 4 [ 2122.440872][ T3154] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2122.448733][ T3148] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:00 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006b80200660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2122.470953][ T3154] loop5: detected capacity change from 0 to 4 [ 2122.499497][ T3154] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2122.505286][ C0] sd 0:0:1:0: tag#1575 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2122.515960][ C0] sd 0:0:1:0: tag#1575 CDB: opcode=0xe5 (vendor) [ 2122.522317][ C0] sd 0:0:1:0: tag#1575 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2122.522797][ C1] sd 0:0:1:0: tag#1594 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2122.531357][ C0] sd 0:0:1:0: tag#1575 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2122.541151][ C1] sd 0:0:1:0: tag#1594 CDB: opcode=0xe5 (vendor) [ 2122.550153][ C0] sd 0:0:1:0: tag#1575 CDB[20]: ba [ 2122.556451][ C1] sd 0:0:1:0: tag#1594 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2122.570559][ C1] sd 0:0:1:0: tag#1594 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2122.579604][ C1] sd 0:0:1:0: tag#1594 CDB[20]: ba [ 2122.614537][ T3176] loop0: detected capacity change from 0 to 512 17:23:00 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800010000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:00 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xfffffffe, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:00 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1600, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2122.657098][ T3176] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:00 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006b90200660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:00 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xff0f0000}]) [ 2122.724287][ T3192] loop5: detected capacity change from 0 to 4 [ 2122.750226][ T3192] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2122.789462][ T3192] loop5: detected capacity change from 0 to 4 [ 2122.792382][ T3206] loop0: detected capacity change from 0 to 512 [ 2122.813314][ C0] sd 0:0:1:0: tag#1567 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2122.817274][ C1] sd 0:0:1:0: tag#1568 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2122.823194][ C0] sd 0:0:1:0: tag#1567 CDB: opcode=0xe5 (vendor) [ 2122.832954][ C1] sd 0:0:1:0: tag#1568 CDB: opcode=0xe5 (vendor) [ 2122.839292][ C0] sd 0:0:1:0: tag#1567 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2122.845588][ C1] sd 0:0:1:0: tag#1568 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2122.854592][ C0] sd 0:0:1:0: tag#1567 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2122.863600][ C1] sd 0:0:1:0: tag#1568 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2122.872602][ C0] sd 0:0:1:0: tag#1567 CDB[20]: ba [ 2122.881593][ C1] sd 0:0:1:0: tag#1568 CDB[20]: ba 17:23:00 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x8000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2122.942757][ T3206] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2122.980498][ T3192] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2123.097046][ C1] sd 0:0:1:0: tag#1598 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2123.106903][ C1] sd 0:0:1:0: tag#1598 CDB: opcode=0xe5 (vendor) [ 2123.113268][ C1] sd 0:0:1:0: tag#1598 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2123.122311][ C1] sd 0:0:1:0: tag#1598 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2123.131353][ C1] sd 0:0:1:0: tag#1598 CDB[20]: ba 17:23:00 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x204) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:23:00 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:00 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800011000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:00 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xff600000}]) 17:23:00 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1700, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:00 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x80000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2123.276555][ T3235] loop5: detected capacity change from 0 to 4 [ 2123.301101][ T3241] loop0: detected capacity change from 0 to 512 [ 2123.311838][ T3235] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2123.325969][ T3241] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:01 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006b30300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2123.367404][ C1] sd 0:0:1:0: tag#1578 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2123.377274][ C1] sd 0:0:1:0: tag#1578 CDB: opcode=0xe5 (vendor) [ 2123.383631][ C1] sd 0:0:1:0: tag#1578 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2123.392684][ C1] sd 0:0:1:0: tag#1578 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2123.401758][ C1] sd 0:0:1:0: tag#1578 CDB[20]: ba 17:23:01 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800012000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2123.421792][ T3235] loop5: detected capacity change from 0 to 4 [ 2123.430922][ T3235] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:01 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1800, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2123.480229][ T3258] loop0: detected capacity change from 0 to 512 [ 2123.512980][ T3258] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:01 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xf0ff0000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:01 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006bc0300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:01 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xffefffff}]) [ 2123.529194][ T3274] loop5: detected capacity change from 0 to 4 [ 2123.541242][ T3274] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2123.617225][ T3274] loop5: detected capacity change from 0 to 4 [ 2123.628155][ T3274] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2123.659729][ T3296] loop0: detected capacity change from 0 to 512 [ 2123.716983][ T3296] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:01 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x281) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:23:01 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x100000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:01 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800018000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:01 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006c80300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:01 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xffffefff}]) 17:23:01 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1900, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2124.168231][ T3318] loop0: detected capacity change from 0 to 512 [ 2124.177112][ T3320] loop5: detected capacity change from 0 to 4 [ 2124.201242][ T3320] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2124.235734][ T3318] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2124.260867][ T3320] loop5: detected capacity change from 0 to 4 [ 2124.276317][ T3320] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:01 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006ca0300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:01 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x200000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:01 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180001c000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:02 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xffffffe4}]) 17:23:02 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1a00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2124.415024][ T3354] loop5: detected capacity change from 0 to 4 [ 2124.424886][ T3357] loop0: detected capacity change from 0 to 512 [ 2124.461127][ T3357] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2124.475544][ T3354] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:02 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006ce0300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2124.576361][ T3354] loop5: detected capacity change from 0 to 4 [ 2124.583096][ T3371] blk_update_request: I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 2124.614061][ T3354] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2124.628097][ T3384] loop0: detected capacity change from 0 to 512 [ 2124.646670][ T3384] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:02 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x300) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:23:02 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x300000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:02 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xfffffff4}]) 17:23:02 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800025000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:02 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006ed0300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:02 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1b00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2125.045958][ T3404] loop0: detected capacity change from 0 to 512 [ 2125.061983][ T3408] loop5: detected capacity change from 0 to 4 [ 2125.083259][ T3404] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2125.095285][ T3408] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:02 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006f20300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:02 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800026000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2125.139990][ T3408] loop5: detected capacity change from 0 to 4 [ 2125.151012][ T3408] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:02 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x400000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:02 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xfffffffb}]) [ 2125.240147][ T3440] loop5: detected capacity change from 0 to 4 [ 2125.248247][ T3441] loop0: detected capacity change from 0 to 512 [ 2125.258940][ T3440] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:02 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800048000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2125.290932][ T3441] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:02 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006f40300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2125.361374][ T3456] loop5: detected capacity change from 0 to 4 [ 2125.380761][ T3456] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2125.445831][ T3456] loop5: detected capacity change from 0 to 4 [ 2125.451835][ T3469] loop0: detected capacity change from 0 to 512 [ 2125.458163][ T3456] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2125.479157][ T3469] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:03 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x402) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:23:03 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1c00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x500000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:03 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xfffffffe}]) 17:23:03 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006fa0300660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:03 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180004c000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2125.955441][ T3492] loop0: detected capacity change from 0 to 512 [ 2125.964302][ T3494] loop5: detected capacity change from 0 to 4 [ 2125.985886][ T3494] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2125.995289][ T3492] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:03 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006020400660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x600000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:03 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800068000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2126.056079][ T3494] loop5: detected capacity change from 0 to 4 [ 2126.066430][ T3494] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:03 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000, 0x0, 0xffffffff}]) 17:23:03 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1d00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2126.167014][ T3530] loop0: detected capacity change from 0 to 512 [ 2126.176173][ T3531] loop5: detected capacity change from 0 to 4 [ 2126.196778][ T3531] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x700000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2126.222362][ T3530] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:04 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x406) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:23:04 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180006c000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:04 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006060400660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:04 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000}]) r4 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @local, 0x1}, 0x1c) ioctl$INCFS_IOC_CREATE_FILE(r4, 0xc058671e, &(0x7f0000000400)={{'\x00', 0x3}, {0x1}, 0x50, 0x0, 0x0, &(0x7f0000000040)='./bus/file0\x00', &(0x7f0000000100)='./bus\x00', &(0x7f0000000180)="defb0bd2c5ab1dc332c48f227ed85697a36e4f8920c24987220f9b96a5a55cc0898ddfd57b26fe", 0x27, 0x0, &(0x7f00000001c0)={0x2, 0x15e, {0x0, 0xc, 0x73, "3de64ee637794eb898d03207cc5fdbddd28987ee1aad94051637d18db0987b8e8a4af23c3f709b169586285207231c4d3c6e913f0b96792efb31c30af22060c8d37a1958f8945bc05811824ad7129503daa8e454b88cf755270e7e7e92c1e221e3c522e90457b9d5f2356e94eb453fb22eff4b", 0xde, "3543117054bab248677a3158fcaa5918c8d5a88c2464cdc18e03e83c91399b1eed7fb1e49a1f2252e22636b57a5a8605653b3f28fd33bf2f436399c96931381b1ca6c7597610a5917da27d966aba0604a218c9860e4ceb77f52fcae454453f13f040c14020ba7a9140c260cbf49237b76db9a1c2074c8e64a46c20f1ca50c7450190a882056b75615162ae23273a5593ba82e64b87b5c28face4f507786f6a1d4b37d2642d33abcb4c9652c8540b095d846d76cc98c362ef94364bf3a6406b2a045525227c430a84ba2a4313cd146e52a4e90b198bfeb0aa7329aa6306cc"}, 0x19, "4890e75bd62cbdecc134321caf1c6c238362c2a70102bd542e"}, 0x183}) 17:23:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1e00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:04 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x800000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2126.831756][ T3562] loop5: detected capacity change from 0 to 4 [ 2126.849025][ T3562] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2126.864489][ T3570] loop0: detected capacity change from 0 to 512 [ 2126.898007][ T3570] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2126.927707][ C0] scsi_io_completion_action: 15 callbacks suppressed [ 2126.927730][ C0] sd 0:0:1:0: tag#1569 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2126.944262][ C0] sd 0:0:1:0: tag#1569 CDB: opcode=0xe5 (vendor) [ 2126.950627][ C0] sd 0:0:1:0: tag#1569 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2126.954948][ C1] sd 0:0:1:0: tag#1587 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2126.959689][ C0] sd 0:0:1:0: tag#1569 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2126.969475][ C1] sd 0:0:1:0: tag#1587 CDB: opcode=0xe5 (vendor) [ 2126.978478][ C0] sd 0:0:1:0: tag#1569 CDB[20]: ba [ 2126.984777][ C1] sd 0:0:1:0: tag#1587 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 17:23:04 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006100400660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2126.998891][ C1] sd 0:0:1:0: tag#1587 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2127.007906][ C1] sd 0:0:1:0: tag#1587 CDB[20]: ba 17:23:04 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0x900000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x1f00, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2127.081155][ T3562] loop5: detected capacity change from 0 to 4 [ 2127.100238][ T3562] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2127.118486][ T3593] loop0: detected capacity change from 0 to 512 17:23:04 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800074000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2127.137662][ T3593] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 17:23:04 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x32d001, 0x55) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x3f, &(0x7f0000000040)=0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x50a40, 0x0) openat(r4, &(0x7f0000000180)='./bus\x00', 0x3096c3, 0x8) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000}]) getresuid(&(0x7f0000001700), &(0x7f0000001740)=0x0, &(0x7f0000001780)) r6 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r7, 0xee00) r8 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r8, 0x1269, 0xffffffffffffffff) ioctl$LOOP_SET_STATUS64(r8, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x27b, 0x0, 0x0, 0x4, 0x18, 0x14, "f48a8506ae0b4b3e9279a4c084ae1f0db8b1903bd5a5a952b03820992eaa8df0cbdfbc2e2d4bd106c72194904f97f9b51a29b22496f4d4380511143afc2721fa", "0b5865d6b10566ff2aab43dfe9628af4f211fe1f618ea33e00c2cc90acb44e058da9699afc2b9493db0035ac23db21e0419be80563946bcad7138dc33e5c915e", "ca2755e15f466362b7220ae77628720c86e4f7318f75a791ee2e1f7a5c103e9e", [0x10000, 0x1]}) fstat(r8, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) r10 = getgid() lchown(&(0x7f00000000c0)='./file0\x00', r9, r10) setxattr$system_posix_acl(&(0x7f0000000200)='./bus\x00', &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f00000017c0)=ANY=[@ANYBLOB="02000000010002000000000002000100", @ANYRES32=0x0, @ANYBLOB="02040500", @ANYRES32=0xee01, @ANYBLOB="02000e00", @ANYRES32=0x0, @ANYBLOB="0200f06f", @ANYRES32=r5, @ANYBLOB="02000400", @ANYRES32=0xee00, @ANYBLOB="02000200", @ANYRES32=0xee01, @ANYBLOB="02000100", @ANYRES32=r7, @ANYBLOB="040001000000000008000400", @ANYRES32=0x0, @ANYBLOB="08000500", @ANYRES32=r10, @ANYBLOB="10000300000000002000000000000000"], 0x6c, 0x2) 17:23:04 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000500660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2127.188507][ C0] sd 0:0:1:0: tag#1544 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2127.198377][ C0] sd 0:0:1:0: tag#1544 CDB: opcode=0xe5 (vendor) [ 2127.204746][ C0] sd 0:0:1:0: tag#1544 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2127.213802][ C0] sd 0:0:1:0: tag#1544 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2127.222848][ C0] sd 0:0:1:0: tag#1544 CDB[20]: ba [ 2127.239850][ T3607] loop5: detected capacity change from 0 to 4 [ 2127.261679][ C0] sd 0:0:1:0: tag#1561 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2127.271539][ C0] sd 0:0:1:0: tag#1561 CDB: opcode=0xe5 (vendor) [ 2127.271651][ T3607] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2127.277869][ C0] sd 0:0:1:0: tag#1561 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2127.277892][ C0] sd 0:0:1:0: tag#1561 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2127.302516][ C0] sd 0:0:1:0: tag#1561 CDB[20]: ba [ 2127.368143][ T3607] loop5: detected capacity change from 0 to 4 [ 2127.376707][ T3607] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2127.397617][ T3628] loop0: detected capacity change from 0 to 512 [ 2127.417032][ T3628] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2127.458038][ T3614] loop_set_status: loop0 () has still dirty pages (nrpages=1) 17:23:05 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x408) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:23:05 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f00000000000000000180007a000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:05 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xa00000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:05 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2, 0x110, 0xffffffffffffffff, 0x83231000) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) close(r2) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000}]) 17:23:05 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000600660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2127.740699][ T3651] loop5: detected capacity change from 0 to 4 [ 2127.752665][ T3653] loop0: detected capacity change from 0 to 512 [ 2127.764314][ T3651] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:05 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006040600660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2127.792933][ T3653] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2127.833872][ T3651] loop5: detected capacity change from 0 to 4 [ 2127.841337][ C0] sd 0:0:1:0: tag#1555 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2127.851199][ C0] sd 0:0:1:0: tag#1555 CDB: opcode=0xe5 (vendor) [ 2127.857533][ C0] sd 0:0:1:0: tag#1555 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2127.863575][ C1] sd 0:0:1:0: tag#1575 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 17:23:05 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f0000000000000000018000fe000002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2127.866840][ C0] sd 0:0:1:0: tag#1555 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2127.876630][ C1] sd 0:0:1:0: tag#1575 CDB: opcode=0xe5 (vendor) [ 2127.885635][ C0] sd 0:0:1:0: tag#1555 CDB[20]: ba [ 2127.891935][ C1] sd 0:0:1:0: tag#1575 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2127.906054][ C1] sd 0:0:1:0: tag#1575 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2127.915093][ C1] sd 0:0:1:0: tag#1575 CDB[20]: ba [ 2127.921187][ T3651] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:05 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xb00000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:05 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) syz_io_uring_setup(0x552, &(0x7f0000000340), &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000eea000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0xffffffffffffffff], 0x1}, 0x0) syz_io_uring_submit(0x0, r4, &(0x7f0000000040)=@IORING_OP_FADVISE={0x18, 0x2, 0x0, @fd_index=0x3, 0x6, 0x0, 0x2}, 0x1000) sendfile(r1, r2, 0x0, 0x80000001) syz_io_uring_setup(0x4036, &(0x7f0000000200)={0x0, 0xbfd, 0x8, 0x1, 0x346}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000280), &(0x7f00000002c0)=0x0) syz_io_uring_submit(r3, r5, &(0x7f0000000300)=@IORING_OP_MADVISE={0x19, 0x6, 0x0, 0x0, 0x0, &(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x17}, 0x6) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r6, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000}]) [ 2127.984764][ T3678] loop0: detected capacity change from 0 to 512 [ 2127.991141][ T3684] loop5: detected capacity change from 0 to 4 [ 2128.004129][ T3684] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:05 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800004020002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2128.049247][ T3678] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2128.081630][ T3698] loop5: detected capacity change from 0 to 4 17:23:05 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000700660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:05 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2100, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2128.106245][ T3698] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2128.120265][ C1] sd 0:0:1:0: tag#1595 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2128.130240][ C1] sd 0:0:1:0: tag#1595 CDB: opcode=0xe5 (vendor) [ 2128.136579][ C1] sd 0:0:1:0: tag#1595 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2128.145617][ C1] sd 0:0:1:0: tag#1595 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2128.154661][ C1] sd 0:0:1:0: tag#1595 CDB[20]: ba [ 2128.169186][ T3698] loop5: detected capacity change from 0 to 4 [ 2128.178232][ T3698] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2128.216783][ T3721] loop0: detected capacity change from 0 to 512 [ 2128.252113][ T3721] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2128.263491][ C1] sd 0:0:1:0: tag#1559 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2128.273352][ C1] sd 0:0:1:0: tag#1559 CDB: opcode=0xe5 (vendor) [ 2128.279701][ C1] sd 0:0:1:0: tag#1559 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2128.288721][ C1] sd 0:0:1:0: tag#1559 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2128.298004][ C1] sd 0:0:1:0: tag#1559 CDB[20]: ba 17:23:06 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x500) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:23:06 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xc00000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:06 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800000030002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:06 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000900660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2200, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:06 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(r1, &(0x7f0000000100)='./bus\x00', 0x200100, 0x41) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x0, 0x10001}]) [ 2128.610000][ T3744] loop0: detected capacity change from 0 to 512 [ 2128.617478][ T3747] loop5: detected capacity change from 0 to 4 [ 2128.647874][ T3747] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2128.655479][ T3744] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2128.698878][ T3747] loop5: detected capacity change from 0 to 4 17:23:06 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x2d, 'cpu'}, {0x2d, 'pids'}, {0x2d, 'pids'}, {0x2d, 'pids'}, {0x2d, 'cpu'}, {0x2b, 'io'}, {0x2d, 'pids'}]}, 0x26) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000}]) 17:23:06 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000a00660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) [ 2128.705754][ T3747] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2128.726492][ C1] sd 0:0:1:0: tag#1588 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2128.736416][ C1] sd 0:0:1:0: tag#1588 CDB: opcode=0xe5 (vendor) [ 2128.742763][ C1] sd 0:0:1:0: tag#1588 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2128.751828][ C1] sd 0:0:1:0: tag#1588 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 17:23:06 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xd00000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) [ 2128.759229][ C0] sd 0:0:1:0: tag#1590 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2128.760857][ C1] sd 0:0:1:0: tag#1588 CDB[20]: ba [ 2128.770663][ C0] sd 0:0:1:0: tag#1590 CDB: opcode=0xe5 (vendor) [ 2128.782073][ C0] sd 0:0:1:0: tag#1590 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2128.791103][ C0] sd 0:0:1:0: tag#1590 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2128.800139][ C0] sd 0:0:1:0: tag#1590 CDB[20]: ba 17:23:06 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800002040002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) [ 2128.914850][ T3783] loop0: detected capacity change from 0 to 512 [ 2128.926216][ T3785] loop5: detected capacity change from 0 to 4 [ 2128.945134][ T3785] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:06 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2300, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:06 executing program 2: dup(0xffffffffffffffff) r0 = creat(&(0x7f0000000140)='./bus\x00', 0x20) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000200)=0x0) syz_open_procfs(r2, &(0x7f0000000240)='attr/sockcreate\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r3, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000040)=0xcaa8) unlink(&(0x7f0000000100)='./bus\x00') fsetxattr$security_ima(r3, &(0x7f0000000180), &(0x7f00000001c0)=ANY=[@ANYBLOB="02c7250212b7364075ca711654c7"], 0xe, 0x1) io_submit(r4, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000}]) [ 2128.958789][ T3783] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2129.002818][ T3785] loop5: detected capacity change from 0 to 4 [ 2129.015839][ T3785] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2129.096427][ T3809] EXT4-fs warning (device sda1): ext4_group_extend:1805: can't shrink FS - resize aborted [ 2129.182062][ T3810] EXT4-fs warning (device sda1): ext4_group_extend:1805: can't shrink FS - resize aborted 17:23:07 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000003400)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) splice(r0, 0x0, r2, 0x0, 0x88000d0, 0x600) write$eventfd(r1, &(0x7f0000000240), 0xffffff14) 17:23:07 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x3, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000b00660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000011500)="ed41000000080000d3f4655fd3f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000080)=ANY=[]) 17:23:07 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$NL80211_CMD_TESTMODE(r0, &(0x7f0000000180)={&(0x7f0000000000), 0xc, 0x0}, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x0, 0x0, 0xe00000000000000, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:07 executing program 5: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000280)="2000000040000000030000003000000005000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001800006040002000b0000000002a367fe5c", 0x5e, 0x400}], 0x0, &(0x7f0000000040)) 17:23:07 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x3af4701e) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28012, r1, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) open(0x0, 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$NL80211_CMD_TESTMODE(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305839, &(0x7f0000000040)={0x15, 0x0, 0x2400, 0x8000000}) read$usbmon(0xffffffffffffffff, 0x0, 0x0) 17:23:07 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) r1 = open(&(0x7f0000000080)='./bus\x00', 0x14d842, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x80000001) io_setup(0x202, &(0x7f00000003c0)=0x0) io_submit(r3, 0x4011, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16006, 0x4000000}]) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000040)={0x4, 0x1, 0x2, 0x0, 0x3}, 0xc) [ 2129.496266][ T3817] loop5: detected capacity change from 0 to 4 [ 2129.503635][ T3822] loop0: detected capacity change from 0 to 512 [ 2129.517131][ T3817] EXT4-fs (loop5): Can't read superblock on 2nd try [ 2129.530796][ T3822] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 2129.578823][ T3817] loop5: detected capacity change from 0 to 4 [ 2129.593326][ T3817] EXT4-fs (loop5): Can't read superblock on 2nd try 17:23:07 executing program 0: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f