d9b230dfb59c38996af05522f61ebd34bbd62d999160e0448f8d6f1e5d9134a9391d12da57551b47d85c14b62aa237c0a9e94d14ff090bb8be146f68a054436caceac00230fbf178a78b0b5e4896f70ebfbd2ba56d6b3fb4f606f9c3d528d97a558e0cea3613dbc730e0085e5a8fb4f6cd3d869f40a443a452b9ec1b6e7dede7934b5d754e4261eb5794612d0d17c125278624697685a94d9019e3db4ec72646bdc7204b9cb1e47234280e9ef7db02cb1f3828dd59f2317a963b5bf7383a8b38d411ead44a04c6814e9cf24aaaebe083343e60f9a48c7a813ade349dbe2dce9f790e73a3b86a156679100d76b7981b77241420654435678a9e74c6f565da5f1cbc068dd33c93129ff90cf652388e06544ee0c220d44c620ad418be027b2a3a3073e979559ac6a355ee589120e6948d0514038ae1eb45e9d66cc9d0d79c6beb89b0b60c5f9c2216096e90583ff851b7a1f2b1b109027d6431d18ee102b6e5fed4fdca761411e4cfcb46284cfc9a71c6a818b269486f3eba06a3a8a059012dca0882ba9462be653734c60a8487bbf7b7645e5df71a99462a02843794522231c16b2ef055c74f787bd680d8d4e48c2feeb330544f40899e340a2dc887b32a7b9677e21006f482ea1c86526826935136cbb08b6cfbda97dfd49b9e94f3864860dbe75377da8257800034c53d49bb56009357590c9142a1a6732d89c7aae45694e19e720e9acb4caa25cb55ae3411ff2837e147a71c7ef8328c35a24a921ca46c3c62853a6b5eadfdc5323be4c2402db1b3b97030e38a79d1b4a50abeb057b6963efdc71a9e3685e91f8488729458b2561b71d61cdd74a18672324235ddedb3d7a59054229066a63b17cf2226b0d721731abaab2a630874f1295f58b547aa8dcf1affc62a8dc19e8b859262b75fcbfb39ed73f1cfce936bca1df649367224dbfe64634e1f6028168abfd18e9095dde9193f80285996c3338f2d72dc799ba90d66aa44413d3e8554656664ea3527e243de7163b569b04698c58e6e403e8395103e1d5efbe8e2491df8cb2c2f00c1009e0985026d77e0500800ce904ea91898827c47501f79572ef38519a8569766a1bf585f00d69aecf3bd7e24bb06b1a66c4c8b600cf3317c6783bfb3dad194953d0784ef70a0e53410eb277eff117081816dfc512dc8e3d49bf48e382db5173467efd20d6311e87fe36ced73bdf84e68fa321272d77764f01908b3266c3f3988157cba2bf370174365b30846ece7e1292c015ba38da3247ffecf174617b7e9d62e3e1ad52f02510c78078761f25b338ffb37e7c39d2afe2e6bb682d38b87a1756a7693a05614002962a57bbc90606f924cc3e8ee3c4a9f6ea7a7025a749b2976361ad30ec2f7ab86aec40e6b090c8b8f280f0de7f31e49cb6facd0fa5578c4c63f8dc8a37cbcf3027b9048fb5063c353e4325f74b3f3c33f30c984d64e68228ea5c8713078a56ebae0cd27904771de4b901c55d04211dd8f6eded90476242d44f7a3173bec78ee0c1347575b526fc51add9de36b43e77b688b91eb5c433d5b2bd8820153aa395a26754268bbc1f560fb8afbd1708072abb3cc8d91b8c96c2c6067226af3b97f94e3e94b95e9c8b7d2562c82b81cb02edc75f062793a81d0a92156deb41514be87aef8d083bc50d568418dc47c189c4aa1889262260cea64f08c425152589aba0773d0f129b516c0648f29421c23f479a567cf9ebd4adeb71146b4bfdda29967aea7e299d061b329e2d3040635d3d4ed846d243a4aa0cec16c578b62fd81d9c3eddd3739c9c7438beae9a13df12bf29c1c1b19064f1989e0f8a03cfd72e09d0d8a8772bff7f7b3c804cc9b0b72b671b5e3f40e46338c7a7d98c08e6e8eb985abc22427346d4744b5a8c25536c17636d45b382a0c13838a5331c5b9e723e6d9bac8cc708c5f7caaed56f3ad55c952732491891afb5c1012595b01bbe35bd1471b5e9f704ab24dbe7a1299acf28376e6ebfbfb67a9ff6fbb5d4d0f5eb07228bd9662ed6117e0794cf1522b8e522fe2ddf89223a38708b1726709d0315fd2e02985c985f47fd6e40439cdebbf54c42acfffab207c841896f45048790be46d10940bbc0b1bd7e4a931bfe03d4710636b46bde6ad76fadfe8199c0010111fdb64d525fafd74ab9b3cfc0250678e72259babd7f15893b90c544ee501555f34de4840f3c57fc194c2e07af973446324ecae2b3c7b322f741a6b92dc3f3be66e1934ad1d3b92b81cb13d99060cc1d09c5681d8ce7731d0f82ec2bf087be74f1dda3d322ad7d7c8720863e64ea615f7185cd7da9dfaf895f562ade5cc7cfbbc1f8541f7e2df7256428ba481f0a4eb1e10b39de325aacd7d4a4f2871ebbf093cc32d70efd5f70e43be0451df80782bad421cb51039feee7e4c7324b6a71d2aad8fa6d91c381e08650c43c9a6d26294cb02d05252d538961385379f503199340e29477eaa64e3946c116de04ec6a674fbc4011e3f7181ac6d9412657adae1371bfc257729cd6cdf7dfab72fbd82"}, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x10000}, @NL80211_PKTPAT_MASK={0xf1, 0x1, "8e92b9e1cabf56b34ac14abd6e2215b2752b987c58d2c2e65a951d7edea1978b40270441c68516dae35ecb00d6cd9575af43411c41ee22318a5fcc03bd80fe055d9723ce1d2f44c5acaf6a99bf714eaaf11d244149ccda4e45f1dd188c9244dfefe31369f9f9e564256cb78cec1576e99817062ed5f7f7dbd6edb889ce06211ab0335aacca3849a549d201ea9194de19ae1440fd3a64454a0d221b56428ea410463112d128f670d8056f7adec91d120d9bcb7f77e11afeadc13803c21d552201d41d7727d4186eb174a9e1c5d3f61a62ca4627929f2e69a5604a3d6b81293d9bd605256dedbeb5a25ee2c44e0d"}, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x10000}]}, {0x1298, 0x0, 0x0, 0x1, [@NL80211_PKTPAT_MASK={0x56, 0x1, "0feda66e61fd78fca20b357fbcbf6ed94de67e0c9abe02d3c745625363725e2b800f068cedde7ff1756d01270f6178c9873867ac0d43fc885a58aae8ef699585c0621c8117131c2eff0b6840ba824f6deb0a"}, @NL80211_PKTPAT_PATTERN={0x22, 0x2, "406977ee0e574f005152028989c09fcd0685a0f9068bb8245307ff182535"}, @NL80211_PKTPAT_MASK={0xfc, 0x1, "7ef2b5247f8620638314326d8f0a6ac6670c2ddb81cfb02ea207c1d619ca2fad519c5a00fe311a3b6c8e1c22d69423ba28dd4b253d4a6fa803936ad19b64dc8caeea8e0857ea05b9d9fcdd1f177a8f669f45c7edf22e2bc5b73d187ef2f331ee44e1da6c070a55028e0361b4a30941bc60aab5c684474222fdf8b390dd2f3872c40574f7b4ff3124fb3b8ec5561caa4f53fcfa5b1e11bdf9c037350f0f2742d5cfee59a3e7772efcb6ffa1963fd8b343a12a19d327451024cc5e602c5e0a7f67a1ea42afe5845ddfd6dab0dc05550fdaa57148235a4e9a94308fc1a88e9ac3efe1a810e226cdd508c07c51f869fdd89904c0cc7b98ceaad5"}, @NL80211_PKTPAT_PATTERN={0x1004, 0x2, "63419092cbe02894ce852e0019bf6154b69f8df3a1f8669cc80e85b49f923a92c8eac56c6ac5fe4fecdf7368b37041b38aa1fbfb8e77253f7ae715bbd40dffef20b5ff08cc2e38a743688e68b8d6882850f2029883a50f86c0fcb0b4d3cbd7a1489587b9f6fa479ef9640f5d86ea7fdc85c5cc5d90eeac0544ba47d91184cffa4bd06170f0e7d955703892d6fd230abbf95585d1a13f772be14b23a9fcc7c8193a007255d117d345e5d66771abdff1d5fb38ef31b9a0ca7a165d665b5fecd4ab59dd813d001ef89532cfda6ebd42f0ad18debf6ef0b23a3064604f93cbc1438c0139716dc3571001bcfb91a88b63b3c31980ae50815ec9a5d970c7c34f183ecb503b0c62ec4d8a9e5b98b4cb6190a2ecac73a3095b53189041dbc92b8874180c3da6092379625b821ddf22a1e39f9ea3d2836c14d956cf47bab5e6a987f3d9b8a198f84bfce0c928c904a7b589da93a0e82740b82c1f3637c0699eeffe0db65a20cfe4b7bd022c30e94311e32263d54168b0a2b59478c9f7cc9b6bd033a0b5ae89d661275e8e20c641b14864fbe818f2b574adac962e3148fe73ccfca79887e747a74013daf82a7ce4ba4800c81441587fd9453a42c346fe0b9d1480ef9ed222c33f1ac99dc0aa1f7ca560c81003f51668ba87370384663bb82fc78dfe9a72281fdce43365a4b26b555f9bdd5822deeddb54366cc8e268cefb7d32c7b89b8bf698e86e08f369d5f7a28f6f68598ff1f20ff265263514929ac327f614f7c09a22534e5de5b941d8767018b679078ec928e7e3185146d4b1f5164d6ee44a72396192b42b7df70023a5507b3238a2f0f1b152a658c4c694ae74fe1574c2eb745ff6e279b90c9855b404bdef6ab8af60626dfaaec386b0239ff43f6ff8b0765cf59e2c2d1c0c7a93c8b6d73f041f4175533f4f85d2f09e83cd9bae576c1d72fbd739a8b57c7adbced675b18cdb85d330c0d8d94a40c3b9ea7eea78946f1ccba0b68aed07923c3489623f631afa9b6b6e7b58e7909daab84ac6efdac47f724ce0fe40e7c92a771edddad6734a05c4b108566b7ea4ae8573ddd094b7780898a4213c18ed4ea907839c274ea463eedea6a971862f881a27a9bde3ec5408ebce542e3b4acf902f66452ea9c46a9d95b457e86db30012bd4e98f3713cd6bfac823a4a1acb625850dca857d56ef1a7f6fa48fe3553e14104addbc0a5fc15173e8251e0bc42ed5e0845125033090cb2e1d6538d600c6a8582155fb1e6f6e0861af22cc86d9f1403d13de80ca5bcd46111dc5014ffc8229842f6624adb826cbde98b131a2df5d848d0ced068ac979f550df6f8069cc060e86da99a110696de4f7cda93898be0a8be02fdc6e51a682d8978917fa1e21e3b90bc27b4fe812fdbcfea2d3b211d052e49b7fc38d81008a023297b5a65d2b3b49476c1a64f25d9494047ad5d38ef9e13beb8897e9e59b44e0078d1ace679bcf13388ebcbca9b32ebb8e3de7c79cb34c64952b8e853dd6092b5d1fbd24a45a30456c733eaab6961f4312b934fc9118d90e44623f34a5fc69c729d04a51838f61f98c518be1125d1eb246faf96d3f4ce3c4f49f716b0b8478c8480981242d2cb3452853e59a4ebf63003c6d996eeafb45ac86b3b563727560e97002281f6f054822c5417119a02bc0a42465b4e8a76927d4d153af786ef2bfd9ef58b7c05cc7f9b310c96637fddaaad1418f86b57fc7e391af506fe4e15c48548082c3bf5f7858e6b44b32165da59d7263aeeed75400e4c579c37ba7cb4586fe0ef2ca38f616d8a0139567f0673bf5f0d409c77319e7b68310f518f7cc4d66524c61add1d11c9e853827173fd89d249bd1c4471627167c38470bd752d0afe4de5544f4df8d1b2c564f40a02ae43b72411281edcd08a2c6d2fcee510c581ddacfaf6dc9ca5358f323e6aba00c4de163ea50a4226e1312645c9a048b4e65fca34da021558075a24565777f3b5f99d0d507853d5c64d8da25b64b8ca6c02685594c6b71ec103a1b0c71716042fc774fe15bb193b6d9cc153add308fc6fe708f364003d8e5983dd58d381fbf1fa9c8305433b20466c3847b9dea4761ee79688ea5c8fea6b85cb636704bc2f54b8e544f64aa03b34f4a8940b8860a92dbfc622aebbe8028a02ed3e62a68f4eff8296ff2115586c0247d18539b55acf0abe2b9e13156c0338a213f1fe64d6daa9629612a326e2ff59a468feb987ea5148578e65b75cc14f9be65381acf780ab24bbf65ce5cd38138f706afd00fb7c602de313b7e3da4d8c8283ae833ec1e3f07435359eca1ef4a753158c44494eeac8e85959782d17b776b729a09d2259ceb56b134f194b8318b97f8e243c206ea80f5f4693592fc22274251f0bf092f82298a375d6635d87bf5a07e8d29131950d3a0a4f8e8e1170b2bfbe54a592e1ec72ecc60d94b8f417d3afd3614e511aa71d7911a1b2e41089c3d332893f037c0c64e2cfc3d28db9ed236880593580be2f70f8868cdf3b538d4ac2bd2be5fd1737dc78bac7c1832cf001445015787fbbb0bcc9458672c1fcbf0ae4e8071350206ac1f133899cd54c272d646f909f922b1959dcd9f7785a97ec2e0e3a4e9ced8d25cc9d72ae31e73ddd97af3d112661cd0494b866a1704eccc5bc64b61fd1d7880135d3e03457d216f11bea04b4212aec6fd03580f0f90c04efe40f847026552c9cd15b3ce5e22cc1eb33fbe81a9a0761a6c98b2b991d4e6631d76706775fd7018562b3110e894b7e41ea4050f5a9375dc1c708a868f7b410577d9bf6ad1d62c370ffc83ace2ea5ccb67bf5e6a085ccd8ab8cbba0ac6d5feccf1ae808dabc72a8711f102f0b3fbf3588dc999a8016e15ee0c52e4fd22c282180a5412984fae647d64674274e01de510ea7863059ed38aaea40d8e7a1d0b4e72c2d8f9ed3f2d0533dabadc3e209770538e05151204fcd2fc5e1e0d8c9128632db1198ea3af30697e748ad94be3c6fa537286303e3e3a776edcef95d39d0dfa326df22b22a4f89085d52943afca092642531bfab87a40b8ce3d140910cd26ae783f5538c17a6208ec24a799817029d32e6ef3db3ed6fe0dd17ee19b3ca4b9988833acfe23c9b47ffe151ee4721f6031b9e4467d871755fd37ee5909724c56d26ccce6dc4ff79e8f841b23b3dde06c2d304fed0b083f167b1ad38e82194475bbd842d321e863da725a660f8cef0c5b8e2048899772c16dce051817e56c2656e8257fc02b8a570a8da817968a4263689afe0daad29fc152b7b551150c3b6dc124e04ce66dad6ecce241dd606e67c59c5ccbbdc01f1ec250d7870b7bd4f76c61900c80b13da9023cbda94a7b1a4ab56cc74554392f220bbb23507e0cf3a74fa90fcf0fae58ee8e0fbdf526589c11ebcfcd0a46a2f372aaa0a39c426981aacbe9d516f091ac7bfd8c5764ed404c92ee21e9215e864e32ba9d139e79f237110729a8961f5298c50dbfc05a9b560c7e4b288761f3277e0089d694c9399b890b870c2c9d803fb86aa48fd610851c6c4eef7dc5e41b6d221e5296658c976332b37eb0bb2b8138341d7d91e04820974cd03c00947f080154db98d9e4eef328b91ec3f2ce9ba6c8f11d60417624304928ce00de4af6d984df862ddce6aa18a21d19bdb46e02c7cd15a475ed99c7b1d4b1ff15ca9c8caf9b5065fa2c479b0d877b354db4694e6a3e5dbad5fcd7e9780e6c98e35fca2dd62a693f07282ac9fc2f783d0d3774c1a976c17ec0603887b7c071d3b524c9fa4762a3e7b208be61f2b4d2a92d3a429fe3408032afbfd48e572ea7a2424c3d532c05b3a168c088a572fadcedcb414f9a4add29fd73140b9829533e2ad8017d2b1c5f80c6ff751ead4a3129997c455ae5541e5a22f92a6c69f27d4b4314ad4e7fb98ae832ab5d5e03248e3d29759df5f539542e9c706b728a2420f4a2ed41ef2a1f6c770b0b7b635f29bbc3e199c498c82c06251e8008d7fa0dd7aad87ef5bca2e2144008736d79647d39cb7524e34b07eda5c4c714bd6101dddc700d85dae4bdffc2c544bae1086d4633fe0674d192ef5fd173b4307c76bdaa8a768780cbe4b1d801b12f28a3f1eff16d7a92ffdb8539fe01b4b04994d042508671dba5a825827c7c0692d18825899cc40befa4da1506d0a50002b4a44a8bc2612c984579f5f05ff25f52837746effa3c160403e258ce1469beb5de2679d3209d45824a8286a3d36a0f35a8a67489952cfa8dc3e7c07cc9753e0ed6ad7a44f5d6531569394fa198578104d3acc6bec37428172ce9c43f1155f6d5cef2c24b5361211b4b6ebf448b7786e9399409ec8c6b320bcc85e7fe7ca82174cacbd60eb5363a1f0a11368bffaa16bef524d2019586e331d4ab833cd2aa7ef498597e0e70d978aaf2eac756650fc4276d7a49f875009ffebe30f665e623e042d69b2928f483143a170950aae0b4ad1c9e255b79d663a94a8a5f678b7ad92f1160aec832392a2b8b713ad25ebecd87d29d303ef8e47d902f8003aaed4f82108c706b4fd76e5ec321ba4166b4a2210b0a2efc4f58134d966a5cbec8503eadad354f6b60ceee56d4f963de003ee88d98c5ee08f065f298ca42b9cf54201a94d8cfa5e13e3c5a16f0bfa29dd217ef7d6cf017850f7d09d88f704fabc922e2188a20b4b82b1ddd7b166a536a4cf044c4f76fa657984546205efc5c9b08fa21a57509fd452c234fba861a0d49b0f44e0d7f20f9e969104fdecfb65465068aaa49dd0fd9518ec48ee0c9f7ef231b3cb7caed2a51f65c929cae02ee38e8e000aa939c3482d0046e2969a37d309d5b05c25d3eebbe49fa52e4c874adfeafc17cb115d33d15662f5951813c283036f259afcad1928eea03456bf4af406ebc32bff48394ac9ffe320cc5647b25fa74b1aab014d6cb7d78c8961b6c6538035d20c68625e54b76a5b9e9e299d5273631609051efdcc5d9414b622c58e9c4d4e9080e309d4de25ace4b40fc74746feaef41c09c1137aa57cb6adb005606a599b7a4b2bcef8011a45210d1de3660c4ea359c2915417b1d980b981559e37f2a4cac286159f38ad586102ab8d28bb2a97ee33edc6420eb1da071dec1403a385a01cdb67a798c0c55de643e6ef692f428efa4069ee22b4ea0bc90105238a6f7f6e1b3523c82bea0ac1d1441b003cdb94e4cf82d6b88317cd5c88ccc80d95b657003188bd7bdf3c209b79458af891ee78ebf353bc126c7c4c851f777b4d034b310c3c363d4f42ecf79ebfcf8742ed4af923b3602a7bfb8aaf226d9f6a71d55532966f0daa7ce9057bd66a6a1cd292f968c4153f8118b33327360c21f904d8bd45f76adcceb6971013d64a173849c57d46b0fa737c6cbb87fdb1299b73fce9c93f47395dc9142bcadb805a7a2d939c377b0f7007c46e3c7e9af1de3aa242f74a0cd73a295cad6c276ca7908ca767c3eecd2f85ceb10fef2b978de86862d51acce7c68c31349714cf080fedeae28d840f9eae7d3e5a5f7d68c13daedd13847761333d4b8d6e8b76c5c0358d7bdedcd5f015b513ea3a6f18a1e4703b56987d062ba15d945f25f10fd3b7a1af4b00c4b6f7562b9b41cd9d53d14cbe320b4988e58c53be3c5bfd61af3d7ae29d0bbf6a5aa2ca233ef002b9fd1491170489f952221c2e88b1b46bd4b5bfd2dc22b481000c0d293b6c1f6acf50d8c05f760f986959dcd953c02d0a9275e6057e9802b711179a4149678f77cb64b13801777e6ef793ba8431742573c4a50551fd944967c9439b29e7935309ca629781b30de3dbe459f0b7b0e17c7027cc9035054c7cd8cbe049bd6fee442e7aaa398500bc46ae"}, @NL80211_PKTPAT_PATTERN={0xc4, 0x2, "05b1bbe3cd5143729c77291c61cb95bba93bf6aa8e7484c69a9ae7edef683a28c96928577e82075ebcfbf7eb84b0d6960e1fc3a2289f40ef0fd17d14c794e0789a00daa8c5fa4673e6e3c03830c39091822567ffc1aebebe9b5f04683b97730703e9655e182e320119fab3b7281b4effa5492016994844e3a32f49d9d911e55961b92da408d5625b1f8a352db701fd0a886ceeec821c5ba9ebc117b6630d5bc4299b490c70743aa401072a57d2c8cca67d3f770fc16b24f5144fba5d49a77e80"}, @NL80211_PKTPAT_PATTERN={0x54, 0x2, "f8d1fec15c428ddd37929ea16f4f5528be9cffba3d1f753298f43dd0f3cfdd6eeb1d2ab56dddc1b4cdf06394235bf4c742274580b1892641274cbdfbc68abe10cf18f58f73eb3c0f368f3c716d43e07f"}]}, {0x18c, 0x0, 0x0, 0x1, [@NL80211_PKTPAT_MASK={0xf7, 0x1, "84bd66c0850fcffff42d371f69fed942ed37a5a7f26f604201fef241f75cebfff3bc8bea0fcf2fcd9677946ce2f719ae29a9ef053f53e2afd6bbfe8d1ff650c1c519393608d19ba9a129e41407e915b1616266ce2056dd10159d7114eb6567db6e31c0e5d6cfd6c0c2800439ee8f24cf93d1d1cf897910b9f39c9061cf15965c2f7a7cc2a324cca6aab0770e0c8fa89d91c7ee1b582fa645ee89ecb6ab910428a4deeeb48aa40930b47eaa5d276ce66e825eddcd48745481ca50e37870158fecfd73562e21314a721dffc64a48b19eb85f0d21cb903de4fbb5930f4ab61575fafaf50a0960736044de56984ccb6fa8b7c38860"}, @NL80211_PKTPAT_PATTERN={0x8a, 0x2, "ed232e6f6d835b0301177394dd14c446afdcfc1c433c59fc4e20fe42381db2dad88728d619e056b2140436ddf8bbdd1bccdf3cfe664a2f2e6e66c5700f8c767b046df4a8feb71e5fe58cbd5782c67f27ffd85f59b5b2f9fdbbc3c8ab8d9736448817d37d4112de1a8abae45028b4990c0c88f6c4c1fc76fa31d3e88417bee6914094cccece07"}, @NL80211_PKTPAT_PATTERN={0x4}]}, {0x49c, 0x0, 0x0, 0x1, [@NL80211_PKTPAT_MASK={0xaa, 0x1, "188197793d7062e36706af18b3a68097ac86f726074a8b30c03fa14114d2f990aa71c4f488fdce88ad5ffd58836e0cc54727b003e5a3abcf730cff7e9a7a6d1f1859ec5fd94b7ddb363434b62a58a475c753a91a923fcae2e503e0eae11282bbf23a7204cb758568749499b4e1f349ef4d977d3fbdc8bb918610e32fb00ca7ff22fc72506c9b5279137f83cf522fb5387a2aef1dfd6c2e55476848b649dca40a43ead56ff9fd"}, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x3}, @NL80211_PKTPAT_PATTERN={0xfd, 0x2, "25d53f288105efefaa04de8ef490cd286c3cd160ac1888f334085fa836b7637c48d77a8c8c647ba780d25683ff16c032ad54b16ab597ff4d8052afc1ef32861be2b8b4e5555d25ad77c3e87d3168bf73b8eaac7fc2b39a42f5b774226b32bbcd820e0c0c8491eac31f9dbb31f90eecc5465d279c465db1b52c7a39d5fedb32aacb58d38e4a2d6437471393dc5919f8808c5fb464c3109d614eaf11ca4f92d5ae03fd172385e6ac42c3ba0041068f42c473c1e60fd06fef96967217aa5fd129268e707eb51df33ef6db4ed9b772ac744a88311c3d5bd6f35c9fc59b93fd9653a0729ee6c5961346ce1703cd6d97874cbbae3a51290bdb77926c"}, @NL80211_PKTPAT_MASK={0xf8, 0x1, "dfd06c5e64fe57f618217526de76908c6dbce55d8eaf6f281e5f18883a91f6a840bc4a5096a65cf5850f7745b8a485d761bf81f52d6664eba37e9ab2ac36141bf70fa50f8e8582773b4ce79cdfef5d994c8bf2452a6059cb1955767b07dd16f57dcb3ab12ca7c28bfa9baa696e1f27f583790fa642500da8be4061af9a4c84c9d1156e11c0a952e6a77aee76b0d02faf1a2fe316b9208bc23006151b52acc7928f4a5c4bac0177e55e85ae552a4ce60c131f66e17e2934ff60e94351adc7fdb5490ffef2a64f71b104699002c11c24c5b2235df82b151a4cc265e81421df23af5aee3301904a5b558ed60de5b4ece9f62cebef7a"}, @NL80211_PKTPAT_MASK={0x2a, 0x1, "bb7995c140a1defa781c372cebc658a5ef1a44d9773dc05556d5d3f9970cd80c6a657475f3cf"}, @NL80211_PKTPAT_PATTERN={0xa2, 0x2, "929ed92a0617aa37034614db0fc464162a2b47b4c5afbfe394a3d4ceedd73d95af1b348022a4f6970c8414f530c510ec52d87db9729aa40be456be21cb1bc6305048751e34046f98aa3f62ba9d9b5d442fb5c002fa53a02583a43e5bf49b32a7cbb4289096e5afb00cb67625c6d9c758a8a066fa29af65e2574b92d3e3c86b17463839f4ee934cbb6c3b4b7af6db0d5f9cbadb16fad0c15c07b48e222b72"}, @NL80211_PKTPAT_MASK={0x101, 0x1, "a4744bbbb4c2fca6369b38040127de7ea365009c4fcf910af7ec43597a5293d6f9c46d3bd8a33bb9a398c4a0e7bca33ee8d83446c298fa2a0313ff03a70e8c2b27fd7f24040514a0e187eda61c825ccabd9a7916029dcc30d30cf2c7388ee726e622d721e93e587b52b5d2b992ee3d9ec59a15418aa4b9b3c2d45a775cf9434b823347472f4f510f2017e3180c418893d2c1a92f8cec54815394c468e36bfaf2e0511134975212a37f5acb36596fa78da66f966640eafbac0a3341ba3ab5c53748b3f826fce563c050210297926f33c343431cc4cb03c61c34555f4acfe4ec4d96099ec37ba3d685180e29c5e25f8eaf70f57063b0e906852c2283d0eb"}, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x3}, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0xfffffffe}, @NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x4}]}, {0x84, 0x0, 0x0, 0x1, [@NL80211_PKTPAT_OFFSET={0x8, 0x3, 0x3}, @NL80211_PKTPAT_PATTERN={0x78, 0x2, "21b00cce1bab58a9f14c7135ce68ed97044f9a3c864641529412241b52d6b8600b823c340307f7d07dd4c47dd94e14139287d75e5821ebeccd7eb79edcb4c02a28ff210d13fbf4cf3b0801fad0442d8b7ce2ff2d0f20c54b837a87ff37b790a92ddfcf2641cd20ffc417f587e90d4ac92c5744ce"}]}]}, @NL80211_WOWLAN_TRIG_NET_DETECT={0x1c, 0x12, 0x0, 0x1, [@NL80211_ATTR_IE={0x18, 0x2a, [@link_id={0x65, 0x12, {@random="78645855c605"}}]}]}, @NL80211_WOWLAN_TRIG_RFKILL_RELEASE={0x4}]}]}, 0x3fa0}, 0x1, 0x0, 0x0, 0x40}, 0x40) 11:13:19 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x0, 0x7, 0x9, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', 0xc000, 0x12) delete_module(&(0x7f0000000000)='\x00', 0xa00) [ 1287.020991][T23788] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1287.021769][T23792] EXT4-fs (loop5): bad geometry: block count 4868 exceeds size of device (512 blocks) 11:13:20 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000414000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1287.087768][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1287.132488][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:13:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) delete_module(&(0x7f0000000000)='\x00', 0xa00) [ 1287.186724][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:13:20 executing program 2: delete_module(&(0x7f0000000000)='\x00', 0xa00) 11:13:20 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000240), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="440000002c002767080000000000ba9abd89a3e9", @ANYRES32=r6, @ANYBLOB="001f00000000000004000a000a000100726f757465000000140002000800030000000000080002"], 0x44}}, 0x0) ioctl$KVM_GET_PIT2(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000001640)) sendmsg$DCCPDIAG_GETSOCK(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f00000002c0)={0x134c, 0x13, 0x400, 0x70bd2b, 0x25dfdbff, {0xa, 0x80, 0xff, 0x0, {0x4e23, 0x4e21, [0x122, 0x7fff, 0x7, 0xfffffe01], [0xca, 0x12af, 0x10000, 0x1], r6, [0xfffffff8, 0x7]}, 0x5, 0x1}, [@INET_DIAG_REQ_BYTECODE={0xa, 0x1, "52dfded868ff"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "bb32733266d7bfa4264809acd16e6a4de2d06db535c4b4762dd7d5fd9e6c9512f98b186a3cf5d51f02cd90cd6344e2537670d91a58ca831734a07654e9355587ae5d88ec5d8d7962aed0b7077fa6e551a07603cd890ea6b208de959b44f9ae208b8e58fd0a1a0f9970ed5be7b68ebff3fd2175232cbd9df0d871add82270cc1b460e405f7750aab99c41207b430ff96ed7f461521c263c7086cda2fafd38d10c4e339c7be8f50e517e59485d672d9ff6766fd2e5e9ea31c5d66648fac0e3ac12a7462d42fd54fff661fe1a2f3b4a8be3a393b60f67de71ed344912adc8ab3bcdbe63b9352d2dbd730925e5e3cbfae249699792c87f2332708cc37609fc85bf6775d2a327eaa163baab1dfb2da63cb45a72936e9db3d3d1427a22a9457f558f60c4aa882ffac8c1e5807efcd74cf905691b9384f16bfe8ca06017df38151fe7a4bf1dd565eb48d4a450b28b6cd073a3adfc731051fee9a13c37eaf90a971396e2e5188a4c8df99fc2bd6dd19f44f7cad008a165ab08d0a4de9b6edf756edcd7ddee6a986e99033af27476a9e71ad2786af5e2b5e48a5d7bf86547af7720a0d24f9448af512bbe14be2f070d5bcad93733cc8c3e8ab47fc9d08338b2c8ade295d98aa6d8fe20b55f8de19994e158aeaa3baf1f0f1b367af17cc12a4f248784bc1164f34764e776d08f378a149cad5b86849e9f4f40793745bfc604a39656a96357cd29ba91ec182690fe7cbaa15d43d6eab51f1d6aec2863cd9a52589ae0c350043cd2b49c0e7ce1d920ff0b9d06db8b0515c2bc2f622a042c90dc83dc75f342bcdd345b1aec5420a3eca0c382895c8e6dfc57232745ca203da4eb0ae38353c15fe06fa67729bd8dc7844197cb79026178b253cdc011426fcc9a926b700bda0ac45b200ca1a0ddefa6ac2b3b43b950304d4ec885f1381d1b6e92eacb921c6f5927c87ece127103bf29c81c4e2f1d06f272c597163960d2711c9cc4a2515478fac2c2258949a5c31839bede2069566dd592fa00ca04bcbea538ff8e72b65124caf04af07f876ce0348ebde1a6933481f29305c546638b23e6565dd98412d47f68d5b73b1b38358789c3180e620ac4f6a0d9c7a00fa47b1eddfdf747767b8409567e31e2621abeec1ec4cbb48294e56ba7f398f2e11c7a7f6a152333acd34842a84968cff8e95c1f9e0d5276c04ed7583dac536ffddb3d1ec5ad6663aabf0849c3033f9f7e0dc9a885cc5b9f18b12038ad33f24e0c5a4afaff07ea2e871621096326233a82c889d327ef4b976ab76a11442558e01277a02c7e50be8b645163a0f4ef6a232e71390dc26c211d579c06c01d559bd8cfccfb1340f713c227e643b3e8d78a50e4a43200942e8a6e64e7491e49026427d0921949a2b3a89e538e462e4ac3fd936e6308f6b01aafa8768c89ca8fbfd3ffd409e4e7d999d56d59c73406d086dcb51771229fe1155d6a344eeb0cb23462f5c5cfb7fe580dfccbd70fed59cf2b809f9e3059dbacbe968b29ce2a2f45059d41fd9895b068e0ef1bd80918a17d0ce6df57c9924a0fa29f38cf5a2fcfc647e9b80f7121a1df6512f50c17f83aaf0bd50e01e9f364afc42921050803de3379235c096b362c761f1fb43af975703de906a7ea1bd62bd42006f5cb8df2ad0e79e8df69e5f28d00b7ccce73e0abaccd2159b3fafeccc0cf6bf1810dedadf10ef1478d4a733c5a4b66572c01daefc71ffdc4414ff88a89dbc538ab8ea0e9a42c9b2b5810f5e6a1cc2fc1f6de6fc154e3a52370c8717009ef4edfe3e10ddf767b988b8385a780246543057b3b92fce2f2573da112460da410a1b6239d77ce2679951ef3ee774393bc7eda00bc89c7e5ce755aec3f6a93d03816eb1c342d7cc2ecca2b4aa45aeeff13ab4d08427bf3f41f8ff61cc86a79c93e26c295af0d8b0b3583d12c42e2ec79a16d7b244aa4d997a57e8205f145f9aa65f7747400d10d981476abe5b27c08d162a60b9f9c8a125a5c645b8577c85855f042d4a1481f641c64d5dbe8c3659b4141f754b3c914cf9bf67748e0c9c604919b522d8c1d4a38e9582091578f381d916d36cf9b41163671f54d90c69b131bc127a60570de21129cfa124cd19b9af38a90c6f3bfc2afa94cca4fd6ad2099c90d9118c62cad488005793b8536e8689eef59aed9433544aed465e6bcb9f4bfb4429087605c17425319388d300d6e0d5a4d9b2464dd09e02bb7fe04e502972077d8c246ed3ee706a810e8339c2a7e58b33583e0b43fab7a5bc685e95e99aeac519f1ac354c395cb4682b4f38ecb26ac51526213941c5ce3145c921238e99e6482ce8fffd8b07336b08ccc077448d4a84351b761c24b83ed2addc394164a150c58b490f932356ec6b95760faa5591e0c78c035df5dadab60c1e2284ab432b156b0aae3e030230df8e496e2e0305852ea68e4f6ad483aa31585e8f42e2f9240829dcc559657d4a345f46aeb19aa9a31d14092e1465a406953924f8501b937ec72c5c7aa97bcbe4db45cb8c6b32f40921326c9c45de63a0c59f54e26d3ef7f34b4296e5a4a30e731e336bcc5ad74062d3119ffa9e8b4623707097217fdce8006f9963512d4d0f27df2845752295cf6f87ec14407843ccbaea95a8bb50ca4659bee61a38463c4964d8bf0d75f116de3402fd0b7e21f3e8f5691ae38daf295a011335162f4183731932b098df1b0052661e2f83e4d6aff94393a1c7f0126f3b3b268787b68a37ef678ffaf16a8eedebaa5040b6c5fdd0275b161bbd9e656176ec397d5b7e7f8750cba366bf765fa77f6159ecf51175f057ac8e690891564e5219d4b95cddb6b22480bb1ad995f9f14e20f4954ff736136f45eb69f51cf469e2162892631d4b5e7a25fce6ff62461e97d9d87b306bffe4b85d31d5053300e93f80697a5c21cf2ea038545424e6fb82a7eb7524596a429e572fd67552c0a56730f1a49f241a6af5892844aa3048564cf691af98327fc059492a1273f4fa728d67d8fc18b535dceb0ea142fafd4c73b428cce39ddba515da7f9dbfb5f56be1bcb62a2f572613e437c56d2a9abe6c50a0003ae6b80ec8658f64111bee20792d7b29d46d9bbbb853aa9e79be14b04b39e51720c669efc5b1de32a71d4c6350006878d67f6a3252fb3a19740f7e46fcc75213d1a15ea38cb7b14d2efce92fe099de4165b976c5e50f01078b178725c918aacbacae09d4d2f9eb6a535368e702d76e929ee67fde4f8a696a5bb180d004b75a0bd2edb4a5c103162930321b09841d9939ad34d3296e7ef22587db7b432336167e5e26f7b9b6f642c8d190a2d367c9e4a6b01541f9a2dfbfe89b8f2d14045b5f0a4e15bdbd38700efc2e5169929053f9bbbdbdfc12ebfb8c4e147fee00502d6686991b68b50b04309bd43097dd6a7b6ba7741f7a738058245d8dc11b825033222f893bcf51b49f2a6b35ddb1cc2e4948a06fd45a192c0564b743496163430eeceab1b081ec23fc1065790f56d01115703ed616d09226020b330b562ab26476ee9c8bc37ad86456e43f728ef30bf61611633706b77de5102aca7fdf95c84ae0fc345f854d6bac9508449b3cdf87483853d5f22435c06f0ad952fa5e54d375f0c308f2df9d35dc2fa1b480776f1f45662e3645404923154863e1dc96f181593b9cfa938a39e4af6ec6aeb3f0e41c99719820431773c570791ad383fc6a38dd6908059b4555492fb64ef5d3f5843a087e4d7532e088caf896ea34f90550dbe8aeebc38438fe6812d0b3e97ff9751111496ce6f013678a7439b478e028657ed8ed23572c9868d4c62ebf44340313ec37b77423d4185fd9bcaa1842afd01e0a126b3fea400806d9e9855e9ec9b73e5bd5d076c5d6ca75b7b91efac1a873fc9343c54e4d1263e285b8007198e2c15b86a4213d08cbd2e98eccac1c416a0d4d5f5c96165c59ff158fe374743be66e000ee5c61ac0a1fb30f5bf572371f2bfed2ac12d5f749c5c13fb823d4d706046b1b4d3de7999885d11f031163925c3fece5bd6a789ffe793f3d5dad68582eeb5c6d22b277d02b40a502ef3a06651b64b26ad35344d34de5cfc46bf5bd37e36ecd37d003c0ba6ec1b23a4c399209aa754d588e1527a1052e79649ce1eb01a77040ed4f971e8990857626cd705063bc4fb3c985727c7cb1de7dd2e80b6f29609930bcd48bd83e36c6e821bb476074ac35117283786c1c23981d59849cb9636a40972ae6e0c26ed984c2af2d575c3630eb7c79e793c671fd13f7f80cbf9bacef24041571ebf6cb26c8ce772ddec5dff6a0e53bbc9c640b6348b34ae1df707522f1bd96b98a5468620a4184195482bb77547c1431dd2a0cc8123d764e1cfbcac7159900e30415c258b7cfe3a0d8d6058d68b09262bc27af56cf33586471555bbb4b70ab471e80ab1069f01d8e605910562748e11c3176bdc980165fcb3fbf5019e85c26ee5991a3f69042d5b5198beddcc8bb0497dd334fe8689510fd4754da10216641aef1f98cf609c1aab9232008cb168956810867c7c13324c01cbadb3ba3ca917d609ef481ad291bd5d97ab8a768273cbd93650c32f38c1a7b1d1f37beb40478b2f9674fbf4a2b24cce3f33f08f3bf4e56b5d59dfab2696a43dc3895f435c73c8d8d7e623573348c9e3ba70629af757bf2a344206895ad561ad918d2081f28dea8b634dea24de9454e1483649a7323d25ebc6d88f869e278df1c6e3e6e57eb393972394a88786f6eb8083ec8165107dfce3c37e9e7e897df2b64a7f16432a3211ad4758cb36d8468202225356bfc8f216574a984464a02c2ef54d6a317763628373d7dde80dc7d8f71553d76df7c17bb0838c351db69b7d0faf889f191f148e409427e76cbd5b987982261d9b01afd0724ac2791f70535471f58217b4ef42884ab09f8d89308673613fb2320f69f553565d1a57242667cee87cb97b29b15365f0dc0531f7bf4a5c767b4b029e233025c06c8210955eec490c1aecef5e77934ac9dedd35e2d80288f37b32c9c5143e991c1ff09fa1314f00675aaabd166c2df324f7d7c82572f7ece11623a8d7f3e319a62212250023a6a43caeacee6cedb0b4eb83f7fdb627d2b91a53678a56e59d36421cd38aa489c70687a77a3ebb83a561c51b933030fafb70f0c092a86e80517dedeb63981f0fb20cf4aff939b585db925dbf0c912e6518b86dc44d6911b6bf24a59156889a69319f4de8e51083df415179e0c4e85aa92399b70d3cf8e7ffaa1db46c5692ecc9b0811eb0977bc95fb8aa84f432cd3a161f652d57fb131d1753d09a0dd7fb5a1131fc70152ba7339dffb7c24be624968d2a952a4a056848f64d13af6eaf4a307e389b6c4ae098a3a049a440bf8c1adff5fb06e49e4ced7c1fe028b2da6559b2061a4e9abf28e673f1cd566f260f48aa83d2fc5e0f06353398eff9cc5b489ae75e44afaec319af84184b6e493c971e29b2e5f3726bd2ad7da8d2a61038edd798ecbe76e6eddcb6cda369661f29f2f6d1d7c280fa3227ecd9a2eb648c095da9c98bc06d2e824dc33a610e3c0951295dbcfda416fe4ce642e0e7b3018e24878c27bc8c96ba34a8245e906a52bbd925ff0021601d2fc1d57675945d4e354d6f6356e4172650017c534c1221bbbafbc521c9c51042934113fe3b9241cf01df9c7721ea423e5a7ab23c9a7079d74471ebb00911ea3911c3fc89aef509a04b5e70f3eb220a2a44a2d92e776d748da7d7561c078c06a21d82588b9a5370bbff03389b8b234a6cfc76a601ccce982ae94267fe8a48798b8e4ce12850795513a3797d236f1242bb79077a2ff696fed0c5d19d405"}, @INET_DIAG_REQ_BYTECODE={0xa0, 0x1, "5a7c2c44e0bdacb4d3c6d05fbe20e5f5b312500f3ac74fd7ec0afab75a1f229a7a1db0c3c75861fc9a43820e839eb94ff3e590796106c63c1732cb178b183423b15c71d8aa45e2b8629816391e0b5ab2b5330a1ac9e8586124db3fa75a6fa11bf0f09fbc6bc7f8f53da78c727e7c49a00810a2b061259d87d905e526507e6f2a9ead39d801fa72e93e4218bc214f29c8ad9840734af7e1e60badc3aa"}, @INET_DIAG_REQ_BYTECODE={0x42, 0x1, "359952f78aafa76193ab1282206d48068e05683911046db9d1ecbc12771abc11e218b28f9fe6a32e5c81d2562b50e21db530df5a021d062b19a9877b4f78"}, @INET_DIAG_REQ_BYTECODE={0x27, 0x1, "8b14dc20fcc34f990a9f424b64021175f89ae03b099b77cf58e6fc31643aaae4f751bc"}, @INET_DIAG_REQ_BYTECODE={0x64, 0x1, "b7269481c788ecb56e61d22580ce0805b3cd7410539a686da4720d6c9ea00611b102b939852ab9b855864280b2d3638e1da22d738f1627ba50eb8c1615117749ce1cf3e027bc3e0f539afdc6757144c9858990c1347bcd7735dbb2a62615c84c"}, @INET_DIAG_REQ_BYTECODE={0x22, 0x1, "5d6728635a24b582229fc86da33e58f922ba772372c1ecf839a34b5e44bd"}, @INET_DIAG_REQ_BYTECODE={0xc8, 0x1, "0d1d592c051e8df6bc13708b2c3f59a887768d15cd4aabc32645dbc50f8aeaa0aa77957d0fa077d5a14b63e9bd0f073adcfb4351bc293c4e7d34fed4624bf2033f8061aa07686b339b42d121fc53c98f24cf3d8f2f27724244392f7e3a4147146d3f9f556bd9d339329cff07c75d07d8935bab3fc2fdeace7309ac1427595911349c534ea996e971cccb8c86781f3e271407cb50957265d0995e92022f8fed8c1795045685d52436094f8bc061508a8c7867ac6964db311c0b9c609c73408e558ea8c2c7"}, @INET_DIAG_REQ_BYTECODE={0x3b, 0x1, "c1e569f2e2196b5d8495563a7c97da9ffcfccaa46440d56901463863c78a398eee8e7f59016be569a7533c7193adfe1c9f5ebf5fd1a9ef"}, @INET_DIAG_REQ_BYTECODE={0x58, 0x1, "a7cf1c68627b4f6fa0da473b6586b7d3c101d6dd59e38e6334e72ed0fcb6e93b9c63e3b0a2be05c7912d1df612c7b0a8877752ad888644e80d1f024cc2c0e7c8e9875636f8464c8a341cfca1b0d3cf1503730e8c"}]}, 0x134c}, 0x1, 0x0, 0x0, 0x10}, 0x20) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1287.261114][T23808] EXT4-fs (loop5): bad geometry: block count 5124 exceeds size of device (512 blocks) [ 1287.288113][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:13:20 executing program 2: delete_module(0x0, 0xa00) [ 1287.392219][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1287.418614][T23821] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1287.445394][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1287.482437][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1287.505288][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1287.529072][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1287.547916][T23788] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1287.675436][T23833] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 11:13:22 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:22 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000415000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:22 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x217, 0x0, 0x0, 0x0) 11:13:22 executing program 2: delete_module(0x0, 0xa00) 11:13:22 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) sendmsg$inet6(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)=[{0x0}, {&(0x7f0000000240)="051674b7b45d261f1ea112bebe12cddba544c115a9f37bd9f98eb6679144535db3b258e07a3a257741cb22b96dea4c79cbc02c48d2eef851c20dcdaeb3ad1cb776959f4337036ac588e56706d52aaa1a55abf906c874b2a591529b4c3efddc34178d42b81d1e9a08344c6633cd6af4dd207de7c6e51e0c2a127b438d72e67cf7ad093839b1", 0x85}, {&(0x7f0000000000)="acaccc09", 0x4}, {&(0x7f0000000300)="10f01883a201dee4f9ae9ef843041b37d10f60fdf971d672ffceee5e575c25998417b08fb34d420e65df3168b9f75f1a795533811a47202b31274fe36d77b83fdfee33deb9e3fc4b86041c5fcc6091194cf779f657933a96eb8dfc8ae7e4d5ed91a6d6cc891261a3dad585d6c7a27f726375bd24eb424b25d92df1c108591efb0fd0873137a055be74b7476d7dfcea64e7553806e66aa5025f470a57eae0042e34815088f19941b9b4337be3ebd69a1579ec6fc85246497ae559705d87d3774fa7bbef5865aa05803228ca7492fb612e449e07371c0e8739", 0xd8}, {&(0x7f0000000400)="80a106852301eb9a3f9954917a7067fed452847b250a1f056c056cd0dad0585322b9aee44974607013554f50a187ded4a736ec77c6a3da47e2f4ebd166d573696997a8d75bb3989dd2c63da29b704ad5bd2d94eeee96c1064e5a47aa54239f1928575cd586d53da2846277fa7af2dff111f318787fa2be886177f8ce94ab051bd174b7cbc0358dd90156c185ecf2c157c9439d134923de578cac09bf711ea657f86a9f9cc1f7008ef7ce4d43ccdc829097e7e977ca005f40192cf906772609dd6643b020e81abca506c7e43f24f92edd3315e47336b53bee08b31b2c43ea51f1ad3845b80d0ad48ee1", 0xe9}], 0x5, &(0x7f0000000580)=[@rthdr={{0x58, 0x29, 0x39, {0x3a, 0x8, 0x1, 0x37, 0x0, [@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @mcast2]}}}, @rthdrdstopts={{0x28, 0x29, 0x37, {0x84, 0x1, [], [@ra={0x5, 0x2, 0x7fff}, @padn={0x1, 0x2, [0x0, 0x0]}, @ra]}}}], 0x80}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:13:22 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x0, 0x7, 0x9, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1290.095187][T23858] EXT4-fs (loop5): bad geometry: block count 5380 exceeds size of device (512 blocks) 11:13:23 executing program 2: delete_module(0x0, 0xa00) [ 1290.172140][T23867] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:13:23 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:23 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000416000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:23 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x0, 0x7, 0x9, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:23 executing program 2: delete_module(&(0x7f0000000000)='\x00', 0x0) [ 1290.384829][T23892] EXT4-fs (loop5): bad geometry: block count 5636 exceeds size of device (512 blocks) 11:13:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1290.426179][T23895] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:13:23 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000417000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1290.471482][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:13:23 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x218, 0x0, 0x0, 0x0) [ 1290.565991][T23910] EXT4-fs (loop5): bad geometry: block count 5892 exceeds size of device (512 blocks) [ 1290.579772][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:13:23 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000418000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:23 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee8000/0x1000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat2(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)={0x40, 0x20, 0x10}, 0x18) getsockname$ax25(r4, &(0x7f0000000240)={{}, [@default, @bcast, @bcast, @default, @default, @null, @remote, @bcast]}, &(0x7f0000000180)=0x48) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1290.621993][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1290.653316][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1290.680243][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1290.680488][T23922] EXT4-fs (loop5): bad geometry: block count 6148 exceeds size of device (512 blocks) 11:13:23 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x219, 0x0, 0x0, 0x0) 11:13:23 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000419000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1290.733986][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1290.750988][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1290.768172][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1290.818389][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1290.863464][T23895] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1290.893789][T23943] EXT4-fs (loop5): bad geometry: block count 6404 exceeds size of device (512 blocks) 11:13:23 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40305829, &(0x7f0000000040)) close(r4) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r4, 0x84, 0x12, &(0x7f0000000000), &(0x7f0000000100)=0x4) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x7eab, 0x695e, 0x3, 0x0, 0x0) 11:13:26 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b", 0xf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:26 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000041a000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:26 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x21a, 0x0, 0x0, 0x0) 11:13:26 executing program 0: ioctl$VIDIOC_QUERY_DV_TIMINGS(0xffffffffffffffff, 0x80845663, &(0x7f0000000480)={0x0, @reserved}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) ioctl$KVM_SET_NR_MMU_PAGES(0xffffffffffffffff, 0xae44, 0x0) ioctl$KVM_GET_IRQCHIP(0xffffffffffffffff, 0xc208ae62, &(0x7f0000000240)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1293.347471][T23984] EXT4-fs (loop5): bad geometry: block count 6660 exceeds size of device (512 blocks) 11:13:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:26 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x0, 0x9, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:26 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x21b, 0x0, 0x0, 0x0) 11:13:26 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000041b000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1293.621390][T24004] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1293.637944][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1293.670473][T24009] EXT4-fs (loop5): bad geometry: block count 6916 exceeds size of device (512 blocks) [ 1293.726727][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:13:26 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) bind$l2tp6(r4, &(0x7f0000000000)={0xa, 0x0, 0x3, @loopback, 0x7f, 0x1}, 0x20) io_uring_enter(r1, 0x450c, 0x3a, 0x6, 0x0, 0x0) 11:13:26 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x21c, 0x0, 0x0, 0x0) [ 1293.803679][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:13:26 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000020000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1293.844026][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1293.881434][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1293.915789][T24033] EXT4-fs (loop5): bad geometry: block count 8192 exceeds size of device (512 blocks) [ 1293.984211][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1293.998637][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1294.015643][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 11:13:26 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000002e000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1294.028369][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1294.043543][T24004] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1294.116611][T24044] EXT4-fs (loop5): bad geometry: block count 11776 exceeds size of device (512 blocks) 11:13:29 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b", 0xf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:29 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) 11:13:29 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000032000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:29 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x21d, 0x0, 0x0, 0x0) [ 1296.352700][T24064] EXT4-fs (loop5): bad geometry: block count 12800 exceeds size of device (512 blocks) 11:13:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:29 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x0, 0x9, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:29 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000003f000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:29 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r5, 0x29, 0x36, &(0x7f0000000240)=ANY=[], 0x8) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, &(0x7f0000000300)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}}) write(r5, &(0x7f00000000c0)="8f2a0a65bd8c06dc0304000e0280a7b6072e63e286a5cefe24876ece", 0x5ac) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000100)='SMC_PNETID\x00') sendmsg$SMC_PNETID_GET(r4, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000180)={&(0x7f0000000240)={0x58, r6, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_bond\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x80) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1296.629580][T24086] EXT4-fs (loop5): bad geometry: block count 16128 exceeds size of device (512 blocks) [ 1296.651464][T24084] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1296.665955][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:13:29 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x21e, 0x0, 0x0, 0x0) [ 1296.678713][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1296.691042][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1296.707614][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1296.719964][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1296.733568][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1296.746463][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1296.764349][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 11:13:29 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000040000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1296.776794][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1296.789141][T24084] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1296.903421][T24110] EXT4-fs (loop5): bad geometry: block count 16384 exceeds size of device (512 blocks) 11:13:29 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000346000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:30 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0) r5 = syz_io_uring_complete(r2) getsockopt$inet6_udp_int(r5, 0x11, 0x66, &(0x7f0000000180), &(0x7f0000000240)=0x4) write$vga_arbiter(r4, &(0x7f0000000100)=@target={'target ', {'PCI:', '12', ':', '10', ':', '16', '.', '16'}}, 0x17) [ 1297.089414][T24118] EXT4-fs (loop5): bad geometry: block count 17923 exceeds size of device (512 blocks) 11:13:32 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b", 0xf}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:32 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000380000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:32 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x0, 0x9, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:32 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, @perf_config_ext={0x10001, 0xffff}, 0x4748, 0x0, 0x0, 0x0, 0x800000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) faccessat2(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x1000) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1299.381011][T24151] EXT4-fs (loop5): bad geometry: block count 32771 exceeds size of device (512 blocks) [ 1299.412799][T24153] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1299.469374][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1299.490693][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1299.511767][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1299.529566][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1299.551060][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:13:32 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x21f, 0x0, 0x0, 0x0) 11:13:32 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000387000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:32 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:32 executing program 0: r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x1c) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x10001}, r0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x10000000}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000000000)=0xffffffffffffffff) ioctl$SOUND_MIXER_READ_RECSRC(0xffffffffffffffff, 0x80044dff, &(0x7f0000000100)) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r1}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) ioctl$SIOCX25CALLACCPTAPPRV(0xffffffffffffffff, 0x89e8) [ 1299.570318][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1299.589705][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1299.652921][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1299.672192][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1299.684290][T24175] EXT4-fs (loop5): bad geometry: block count 34563 exceeds size of device (512 blocks) [ 1299.693542][T24153] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:13:32 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000007b6000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1299.962455][T24193] EXT4-fs (loop5): bad geometry: block count 46599 exceeds size of device (512 blocks) 11:13:32 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x220, 0x0, 0x0, 0x0) 11:13:33 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003d0000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:33 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:33 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsu(&(0x7f0000000180)='/dev/vcsu#\x00', 0x9, 0x20000) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f00000004c0)=0x200, 0x4) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r5 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) shmat(r5, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) shmctl$SHM_LOCK(r5, 0xb) r6 = pidfd_getfd(r1, r2, 0x0) recvfrom$rose(r6, &(0x7f0000000540)=""/37, 0x25, 0x100, &(0x7f0000000580)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, 0x2, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}]}, 0x40) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1300.235568][T24209] EXT4-fs (loop5): bad geometry: block count 53251 exceeds size of device (512 blocks) [ 1300.364816][ T34] audit: type=1800 audit(1603883613.284:253): pid=24215 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1300.409482][ T34] audit: type=1800 audit(1603883613.284:254): pid=24215 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=1 res=0 errno=0 [ 1300.434733][T24221] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1300.457171][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1300.488695][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1300.503064][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1300.518054][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1300.532434][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1300.546602][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1300.561100][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1300.573565][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1300.585918][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1300.599972][T24221] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:13:35 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb30", 0x17}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:35 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000026e2000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:35 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000240)={0x0, 0x1e0, 0x340, 0x280, 0xcc, 0x9, 0x0, 0x2, {0x1, 0xfffffc01, 0x1}, {0x1, 0x7f, 0x1}, {0x80000001, 0x1f}, {0x7fff, 0x80000000, 0x1}, 0x1, 0x40, 0x9, 0x9, 0x1, 0x2, 0x0, 0x1, 0x3, 0xffff, 0x4, 0x5, 0x1, 0x2, 0x1, 0xb}) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:13:35 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x221, 0x0, 0x0, 0x0) [ 1302.458890][T24246] EXT4-fs (loop5): bad geometry: block count 57894 exceeds size of device (512 blocks) 11:13:35 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:35 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x0, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:35 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000026e5000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:35 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x222, 0x0, 0x0, 0x0) 11:13:35 executing program 0: r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x9, 0x109000) io_uring_register$IORING_UNREGISTER_FILES(r0, 0x3, 0x0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d7000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r1}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1302.740286][T24269] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1302.769478][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1302.810082][T24280] EXT4-fs (loop5): bad geometry: block count 58662 exceeds size of device (512 blocks) [ 1302.822412][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1302.835060][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1302.847669][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:13:35 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003ee000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1302.861886][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1302.882843][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1302.945519][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1303.000304][T24294] EXT4-fs (loop5): bad geometry: block count 60931 exceeds size of device (512 blocks) [ 1303.015972][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 11:13:36 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003f0000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1303.081106][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 11:13:36 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x223, 0x0, 0x0, 0x0) [ 1303.142706][T24269] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1303.183088][T24306] EXT4-fs (loop5): bad geometry: block count 61443 exceeds size of device (512 blocks) 11:13:38 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb30", 0x17}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:38 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, @perf_config_ext={0x74ac000, 0x9}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080)={0x0, 0x4, 0x0, 0x0, 0xb8}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) ioctl$RNDCLEARPOOL(0xffffffffffffffff, 0x5206, &(0x7f0000000000)=0x121000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) mremap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x7fffdf004000, 0x3, &(0x7f0000ffd000/0x2000)=nil) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r5 = fcntl$dupfd(r1, 0x406, r0) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r5, 0x40045730, &(0x7f0000000100)=0x1000) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40305829, &(0x7f0000000040)) close(r4) r6 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f00000002c0)={r6, 0x0, 0xfffff000}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r4, 0xc058534f, &(0x7f0000000240)={{0x4, 0x3f}, 0x0, 0x6, 0x6, {0x8, 0x3}, 0xf6, 0x4}) 11:13:38 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003f2000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:38 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x224, 0x0, 0x0, 0x0) [ 1305.446265][T24331] EXT4-fs (loop5): bad geometry: block count 61955 exceeds size of device (512 blocks) 11:13:38 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:38 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x0, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:38 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003f4000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:38 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:13:38 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x225, 0x0, 0x0, 0x0) [ 1305.802122][T24362] EXT4-fs (loop5): bad geometry: block count 62467 exceeds size of device (512 blocks) [ 1305.839243][T24366] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:13:38 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003f6000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1305.868377][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:13:38 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x226, 0x0, 0x0, 0x0) [ 1305.978318][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1306.014407][T24386] EXT4-fs (loop5): bad geometry: block count 62979 exceeds size of device (512 blocks) 11:13:38 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003f8000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1306.024585][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1306.086027][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1306.121368][T24391] EXT4-fs (loop5): bad geometry: block count 63491 exceeds size of device (512 blocks) [ 1306.147235][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1306.226829][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1306.284260][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1306.322994][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1306.378255][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1306.421262][T24366] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:13:41 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb30", 0x17}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:41 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080)={0x0, 0x5027}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0)='devlink\x00') sendmsg$DEVLINK_CMD_GET(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)={0x14, r5, 0x4da6697c0d059b15}, 0x14}}, 0x0) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x88, r5, 0x100, 0x70bd2d, 0x25dfdbff, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x7fffffff}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x6}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0xb, 0x7fffffff}}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x4) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_out(r6, 0x5460, &(0x7f0000000100)) remap_file_pages(&(0x7f00006d4000/0x1000)=nil, 0x1000, 0x1000004, 0xe6da, 0x20000) r7 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) sendmsg$DEVLINK_CMD_PORT_SET(r7, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[@ANYBLOB="7000e3a3f7bbfab5fe4b1237aac4b10000", @ANYRES16=r5, @ANYBLOB="010025bd7000fedbdf25060000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300030000000600040002000000080001007063690011000200303030303a30303a31302e300000000008000300010000000600040002000000"], 0x70}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 11:13:41 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x227, 0x0, 0x0, 0x0) 11:13:41 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x0, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1308.469494][T24415] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1308.485805][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1308.498666][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1308.574685][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1308.623248][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1308.706132][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:13:41 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:41 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003f9000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:41 executing program 0: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x7f, 0x200) ioctl$UI_GET_VERSION(r0, 0x8004552d, &(0x7f0000000100)) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r1}}, 0x0) mq_open(&(0x7f0000000180)='\x00', 0x1, 0x58, &(0x7f0000000240)={0x6, 0x0, 0x6, 0x3}) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1308.751452][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 11:13:41 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x228, 0x0, 0x0, 0x0) [ 1308.793145][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1308.859774][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1308.896100][T24447] EXT4-fs (loop5): bad geometry: block count 63747 exceeds size of device (512 blocks) [ 1308.907129][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 11:13:41 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003fc000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1308.972162][T24415] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:13:41 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0x0, 0xffffffffffffffff, 0xa) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:13:42 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40305829, &(0x7f0000000040)) socket$xdp(0x2c, 0x3, 0x0) close(r4) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0xbc}, 0x8) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1309.107006][T24474] EXT4-fs (loop5): bad geometry: block count 64515 exceeds size of device (512 blocks) 11:13:42 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x229, 0x0, 0x0, 0x0) 11:13:42 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000003fe000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1309.420601][T24497] EXT4-fs (loop5): bad geometry: block count 65027 exceeds size of device (512 blocks) 11:13:44 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873", 0x1b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:44 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000020000000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:44 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x22a, 0x0, 0x0, 0x0) [ 1311.549754][T24518] EXT4-fs (loop5): bad geometry: first data block 0 is beyond end of filesystem (0) 11:13:44 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:44 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0x0, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:44 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000100)='tls\x00', 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:13:44 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000020002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:44 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x22b, 0x0, 0x0, 0x0) [ 1311.866824][T24543] EXT4-fs (loop5): inodes count not valid: 33554464 vs 32 [ 1311.888758][T24545] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1311.946160][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1311.971476][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:13:44 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000030002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1311.990974][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1312.009398][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1312.039311][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1312.062895][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1312.079520][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1312.097119][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1312.125106][T24564] EXT4-fs (loop5): inodes count not valid: 50331680 vs 32 11:13:45 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x22c, 0x0, 0x0, 0x0) 11:13:45 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000040002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1312.159304][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 11:13:45 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000100)='hugetlb.2MB.limit_in_bytes\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r5, 0x40305829, &(0x7f0000000040)) close(r5) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000180)={r8}, 0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000180)={0x5, 0x4, 0x10708, 0xe672, 0x400, 0x81, 0xdf, 0x7, r8}, 0x20) ioctl$HIDIOCGRAWINFO(r5, 0x80084803, &(0x7f0000000240)=""/148) ioctl$BLKRRPART(r5, 0x125f, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1312.232368][T24545] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1312.296379][T24583] EXT4-fs (loop5): inodes count not valid: 67108896 vs 32 11:13:47 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873", 0x1b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:47 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000050002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:47 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x22d, 0x0, 0x0, 0x0) [ 1314.584218][T24612] EXT4-fs (loop5): inodes count not valid: 83886112 vs 32 11:13:47 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:47 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = openat2(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)={0x402000, 0x13, 0x8}, 0x18) write$P9_RWSTAT(r4, &(0x7f0000000180)={0x7, 0x7f, 0x1}, 0x7) 11:13:47 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0x0, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:47 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873", 0x1b}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:47 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000060002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:47 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x22e, 0x0, 0x0, 0x0) [ 1314.903596][T24639] EXT4-fs (loop5): inodes count not valid: 100663328 vs 32 [ 1314.919843][T24638] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:13:47 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0x0, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:47 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000070002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:48 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x22f, 0x0, 0x0, 0x0) 11:13:48 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000002280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0xa, [@fwd={0x4}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x1, 0x3ff}}, @const={0xc, 0x0, 0x0, 0xa, 0x5}, @volatile={0x4, 0x0, 0x0, 0x9, 0x5}]}, {0x0, [0x5f, 0x2ffba89619de0099, 0x0, 0xe, 0x2e, 0x51, 0xfc98dc1913d7c5b8, 0x30]}}, &(0x7f0000002300)=""/102, 0x5e, 0x66}, 0x20) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40305829, &(0x7f0000000040)) close(r4) read$FUSE(0xffffffffffffffff, &(0x7f0000000240)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_WRITE(r4, &(0x7f0000000000)={0x18, 0x0, r5, {0x6}}, 0x18) [ 1315.200873][T24672] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1315.221019][T24671] EXT4-fs (loop5): inodes count not valid: 117440544 vs 32 [ 1315.238535][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:13:48 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x230, 0x0, 0x0, 0x0) [ 1315.308134][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:13:48 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000080002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1315.403866][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1315.423933][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1315.480598][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1315.527034][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1315.544544][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1315.585919][T24707] EXT4-fs (loop5): inodes count not valid: 134217760 vs 32 [ 1315.592017][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1315.619362][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1315.655986][T24672] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:13:50 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:50 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r4, @ANYBLOB="00000000fffff8ffff000000000900010068667363000000000800"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="440000002c002767080000000000ba9abd89a3e9", @ANYRES32=r4, @ANYBLOB="001f00000000000004000a000a000100726f757465000000140002000800030000000000080002"], 0x44}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="440000002c002767080000000000ba9abd89a3e9", @ANYRES32=r7, @ANYBLOB="001f00000000000004000a000a000100726f757465000000140002000800030000000000080002"], 0x44}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000480)={'syztnl2\x00', &(0x7f0000000400)={'gre0\x00', 0x0, 0x80, 0x7f98, 0xfff, 0x1122fee1, {{0x10, 0x4, 0x2, 0x0, 0x40, 0x67, 0x0, 0x2, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, {[@timestamp_prespec={0x44, 0x14, 0x5e, 0x3, 0x8, [{@multicast1, 0x2}, {@broadcast, 0x8}]}, @timestamp={0x44, 0x18, 0x3b, 0x0, 0x1, [0x0, 0x6, 0x2, 0x2, 0x9]}]}}}}}) recvmsg(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f00000004c0)=@can={0x1d, 0x0}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000540)=""/88, 0x58}, {&(0x7f00000005c0)=""/62, 0x3e}, {&(0x7f0000000600)=""/170, 0xaa}, {&(0x7f00000006c0)=""/157, 0x9d}, {&(0x7f0000000780)=""/227, 0xe3}], 0x5}, 0x2001) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000009c0)={'syztnl1\x00', &(0x7f0000000940)={'syztnl1\x00', 0x0, 0x4, 0x31, 0x3, 0x6, 0xc, @mcast1, @remote, 0x0, 0x40, 0x800, 0xa13}}) sendmsg$ETHTOOL_MSG_DEBUG_GET(0xffffffffffffffff, &(0x7f0000000bc0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000b80)={&(0x7f0000000a00)={0x164, 0x0, 0x2, 0x70bd29, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}]}]}, 0x164}, 0x1, 0x0, 0x0, 0x4000010}, 0x20000010) 11:13:50 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000090002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:50 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x231, 0x0, 0x0, 0x0) 11:13:50 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x0, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:50 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc33", 0x1d}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1317.912377][T24728] EXT4-fs (loop5): inodes count not valid: 150994976 vs 32 11:13:50 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000a0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1317.954040][T24733] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1318.031207][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1318.065799][T24752] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1318.130297][T24754] EXT4-fs (loop5): inodes count not valid: 167772192 vs 32 [ 1318.134043][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1318.164383][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:13:51 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000b0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:51 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x232, 0x0, 0x0, 0x0) [ 1318.224053][T24752] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 1318.237191][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:13:51 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c0000001400010000000000000000002c007094e12808203033e48bf40a73400c020073797a3200000700"], 0x1c}}, 0x0) dup(r4) [ 1318.280194][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1318.313509][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1318.338304][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1318.368342][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1318.373363][T24777] EXT4-fs (loop5): inodes count not valid: 184549408 vs 32 [ 1318.415352][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1318.488781][T24733] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:13:51 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000c0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:51 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x233, 0x0, 0x0, 0x0) [ 1318.687331][T24794] EXT4-fs (loop5): inodes count not valid: 201326624 vs 32 11:13:53 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:53 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000d0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:53 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r4, 0x4010942a, &(0x7f0000000000)={0x1, 0x1}) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r5, 0x40305829, &(0x7f0000000040)) close(r5) ioctl$LOOP_CHANGE_FD(r5, 0x4c06, r0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40305829, &(0x7f0000000040)) close(r6) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000180)={r6, 0x15, 0x0, 0x2e2, &(0x7f0000000100)=[0x0, 0x0, 0x0], 0x3}, 0x20) 11:13:53 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x234, 0x0, 0x0, 0x0) 11:13:53 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x0, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:53 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc33", 0x1d}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1320.932314][T24817] EXT4-fs (loop5): inodes count not valid: 218103840 vs 32 [ 1320.958434][T24819] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:13:53 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000e0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1320.991886][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1321.033421][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:13:54 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40305829, &(0x7f0000000040)) close(r4) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r4, 0x89fa, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000240)={'ip6_vti0\x00', 0x0, 0x2b, 0x9, 0xff, 0x7efe, 0x0, @empty, @dev={0xfe, 0x80, [], 0x41}, 0x1, 0x700, 0x1, 0x4}}) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:13:54 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000f0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1321.096046][T24847] EXT4-fs (loop5): inodes count not valid: 234881056 vs 32 [ 1321.116515][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:13:54 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000100002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:54 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x14040, 0x0) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2, 0x0, 0x0, r1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1321.202313][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:13:54 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x235, 0x0, 0x0, 0x0) [ 1321.259441][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1321.311025][T24868] EXT4-fs (loop5): inodes count not valid: 268435488 vs 32 [ 1321.313966][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1321.333057][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1321.369398][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1321.406284][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1321.433907][T24819] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:13:56 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:56 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm-control\x00', 0x0, 0x0) r5 = open_tree(r4, &(0x7f0000000240)='./file0\x00', 0x1000) ioctl$sock_inet_udp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000100)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:13:56 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000110002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:56 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x236, 0x0, 0x0, 0x0) 11:13:56 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x0, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:13:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc33", 0x1d}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1324.065563][T24913] EXT4-fs (loop5): inodes count not valid: 285212704 vs 32 [ 1324.076928][T24904] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:13:57 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000120002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:57 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0x0, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1324.262917][T24930] EXT4-fs (loop5): inodes count not valid: 301989920 vs 32 11:13:57 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x237, 0x0, 0x0, 0x0) 11:13:57 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000130002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1324.342458][T24939] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1324.358724][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:13:57 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x44a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f0000ee7000/0x3000)=nil, 0x3000, 0x800002, 0x20010, 0xffffffffffffffff, 0x8000000) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(0xffffffffffffffff, 0xc0305602, &(0x7f0000000000)={0x0, 0x7fff, 0x200e}) [ 1324.384771][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1324.404629][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1324.446126][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1324.484036][T24953] EXT4-fs (loop5): inodes count not valid: 318767136 vs 32 [ 1324.509861][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1324.527709][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1324.545172][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 11:13:57 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000140002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1324.573564][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1324.594292][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1324.620111][T24939] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1324.735574][T24968] EXT4-fs (loop5): inodes count not valid: 335544352 vs 32 11:13:59 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:13:59 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x238, 0x0, 0x0, 0x0) 11:13:59 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000001b0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:13:59 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80}, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x40}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x402000, 0x0) getsockopt$inet_sctp6_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f0000000100), &(0x7f0000000180)=0x8) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r5, 0x40305829, &(0x7f0000000040)) close(r5) read$FUSE(r5, &(0x7f0000000240)={0x2020}, 0x2020) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:13:59 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0x0, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:00 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1327.035288][T24985] EXT4-fs (loop5): inodes count not valid: 452984864 vs 32 11:14:00 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000001c0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:00 executing program 0: ioctl$TIOCGWINSZ(0xffffffffffffffff, 0x5413, &(0x7f0000000000)) ioctl$TIOCL_GETSHIFTSTATE(0xffffffffffffffff, 0x541c, &(0x7f0000000380)={0x6, 0x57}) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000001400010000000000008000002c00f4ff73797a3200006781400cf3f3295d61f05bd4786e6ebfacee8ebbc345d204993679036ee16c7e0b743d9c00be"], 0x1c}}, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) r3 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x80, &(0x7f0000000140)=0xffffff5f, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000180)={&(0x7f0000000100)=[0x7, 0x7, 0x6430], 0x3, 0x0, 0x0, 0xffffffffffffffff}) getsockopt$SO_J1939_PROMISC(r6, 0x6b, 0x2, &(0x7f0000000240), &(0x7f0000000280)=0x4) io_uring_enter(r3, 0x450c, 0x3a, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f00000003c0)=0x11, 0x4) [ 1327.132230][T24995] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1327.143335][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1327.196297][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1327.250130][T25015] EXT4-fs (loop5): inodes count not valid: 469762080 vs 32 [ 1327.271351][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1327.287294][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:14:00 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000001e0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:00 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x239, 0x0, 0x0, 0x0) 11:14:00 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = syz_open_dev$vcsa(&(0x7f0000000240)='/dev/vcsa#\x00', 0xffff, 0x183041) ioctl$ASHMEM_GET_SIZE(r4, 0x7704, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x5, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x7, 0x0, {0x0, 0x0, r5}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) socketpair(0x29, 0x6, 0x80, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) write$bt_hci(r6, &(0x7f0000000180)={0x1, @le_set_adv_set_rand_addr={{0x2035, 0x7}, {0x8f, @fixed={[], 0x11}}}}, 0xb) [ 1327.317324][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1327.393469][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1327.420333][T25040] EXT4-fs (loop5): inodes count not valid: 503316512 vs 32 [ 1327.445349][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1327.478462][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 11:14:00 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000220002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1327.498802][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1327.518488][T24995] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1327.639005][T25051] EXT4-fs (loop5): inodes count not valid: 570425376 vs 32 11:14:03 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:03 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x23a, 0x0, 0x0, 0x0) 11:14:03 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000000)=0xe00000000, 0x8) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) pwritev(r4, &(0x7f0000000100)=[{&(0x7f0000000240)="6b3c06be40c9b4bdd7fac58c0e4894be1dfb3909c0d9a7abbf6411ba0c310c9611297fef4c20aa7ca1894eab6c5b1f1da709d0db8be4786b3a316e20cb835cab608810c36ee262743b165edf7661145f53259d47484c3c61e6c65d69cd7d74f951b78ae7555ed491b12d99d030016e3129c98524135fb130748d079a8050deb1f73051467fca5236ce75f311c31df688982e946705d7c17e814ef904666d693c8e6aecf06c65b3bbfb47e4ea3d99bff0ea738dc471abf37136dcf912ff72ea409d9722d1e4eb991aa8e1759cfd8f9d5484abaa37ae9886662a1aa7417208632e9db0f3beb17202897b484d9aebd384203a8cd0d66839ec27799090ea8626ff099fdd26362621aeca4ecf8b55d81f607824cd8674a993d43e32bd6eee1afa69d1c78bc64b11b360d61516e7740433a8c091c45947f91e9a600ee6582303cedb519bfe38abf5aa47e1569f052d4b540b05f03276ea58d41447c81695c131c61bb4090dbf75cbac4c6cbf89b050ef1f989df82e9c87abdbeee5ffeaf3155cf4a570c58e1fc0b00f7ab4dfb65ce290394c95728d13b63a032d8fda366a2b0bddae0d5b35a5d34703fcbb99d38c924ad95c54d43bc46f8e1ba0b1114c8d9f77814d078344ad81e01e8d9cecf49ebb80efd73fd36b3514b4e7dd56042d56f08797fd4a741953241f63021b2536e4ae0da8427e75ec3ce35c598d21280a69bb41ab14ad6b1bc04005423e282246554845fd0db1a1c5761155fe4ed432c1d56c43c58a3ddd8431317eb6dfe481428c281830d37d0b208436f7281b1e30e5bc229aa0d3e09a71e961bbe78c246457795096870f5e09a327c84c01af958da6c09d8aee287642f7f0b6b40d91eb418ea3a409c58438b043177f4f73580cd0d044bc81fbb5aac6781ee9a855588f6e4e965f707c114c7a9669aba5297ab4e64dd72765ece4ac1e835082989d7769a53916e08c1f3c0233f87dee208464e381f63c5910bed3ae0b5f221acd63ad52dfab1cbea0e5b276d00969c1e1924f0229f38e1e0c5ea1ce7025b2b4df061eaccbf73f190d7e1f9579088158fbe1e2836a1f3b4b1b77e5d0e861dda848101488690cf5a755019bff21f9df32ecf8b375051c5854bb303daa48c3965bfdee19f6b5a75dd2fce1190ee888bbe0ca051c09fe2883fe317b5e712dffde36a8f9b297667d7fa7f61ec10d6c6a48529aa70e06b4f54100769590ae3c30d94ee9facbfe6418fb98bdea674d44c96c9a4a884bc4a9af7cbd9e73964bc4768f2833af496e22b84448ef2abc466f20bf180742b66676c7719a2e4ccdad4bb2415e55ec0ad153eb7b237b71f2d5de946ea956ade440803bfa47a6a8d34610f26e499a6df1236d31472c78a85bccdca8e7cdf6bc48ad3dd2c179b246567804f0ca1ad05b472fb985d51e5858f4145c83dbecb80d95f9e235224af6bc8c7acb1fdcc95bf89c7b56f7b1852478cbb90cadd16cc4e9c226d5f7ac6c28a2081f44cf7bc0517a959f69a4d8d844926f10167dd84a43da451d240c97e56af92c8e283bacdb43cc204240e3d790a773fad45d69e23a90361bdaa2d038c0530acb2d292daa4e94d9d0314c093d87fd84463173b2422e4d38cffdbf39853f5d482845d276fbeb50296dcd0635d895ed71f0a26b49ad86514ecd7953dfdbdfe9c30b56b858817bff94661abdf01707213daad750727b8d600482987714890611a4e835ccce4a23b6e89825ce23df040d2ae083892772bdbcf379c1f4b1eec9272e522244fb918f234f4bb7fbd33231f5c493d00e6e9b6f434b0f2d7c90ad3b0b3c051297ac05748930763b32f815af6a33bebf73480dfc4dc0db1e719350c244f826d7182fc89fcf723ba1d1f1b64c52db18d928ad905c53a17cbf93f8c2e537e561e036c932b851618611156326a563898fa697a993a8bc25508b617b2ff3088c44e3363b122b4ba4bf84e797778ec1ee0aec2708609747484ed64ea45ef9b73a2f8ff50a0e3f1d662e85a51d0c8221775711cd8d56c6f06d326cf689330a114ce21ea14a7f567f03e634f6d287d1fdabd178c000ab1b230e9a1b10fff08e9db2ebe6072ac165882c03e6b172ac47f179f22cfe386994ac01ac41d54be07d78a476a4fa1850a66c05619c7a39fadef4e475c142041399d2d9b5c27e6c6e607ec271de8350cdf15c4e1c6318f8b328acfe11e3a606555c216e70f6762d40bc573e7acfb2e191a8693ee34950b9bfc96aa0c4037ffffdbf5b171f7874926a6993a8531dc9f3c760b79bd0354569171a3d2bfabe6312b6eac5e75a684638ae1d61ef045ac57372efa059a1a7821300536bd345519107a7d7150dca947c9304a030ca0e4ebba2c9b111dce8b87a267da28c264b460cce555119628353923d02767b4d057f4c7a699a9311af7250cd1adb7e0b21408884840f8c9ade88042f92dadcc8d8faa66b4f3ff4f33fe6254e86ed13e4e45f9949590e9d5829c22036b20a8f1abec4a2fa23babd19ceb277ade0ceef6846e2eda89ea2f43a7eb47b5618e3a1ff3a2d1ac37f132d38f473b29674909e289ac251fede2df6dee69377a2fec5cd9533deb2f1290c44ba933f1955324de738c203f7259f4e9be300d8fa3e82e7f8bdc208fe118e200ea7cf1b4ca6c45f2d2679628b65630babc6c84dc6f2a42257433d926a69863f1b3b228d615ce7185120ae78a3d370c0af7c77133ad3d5454c92aa5e8059a6764a51ae9c8532e0567b48a436fc4bfe1d528e9c7bb03d0cb488ed06810f3f86a6b39f7498b6b8e265000bf49c29e02326c0e39c11ed7fc02268c3ef577c9bb0d0b44b1fc51f7bbd54c9e6b5ff030603968743ca8e8b84473d284273da69a8897774ccdecfdf2db8d381e62b8c52f9c01428f086c43caab8f11bd187e82c6dfe1ea5da6e75860327168e7378fb2ec5dfa221c8540573a2241142890fa1ed12646659f9c5980624e9f03ebfc132161b85d50df0fc688afad3aaf15ddcbd1b47cb0c53fd807b12f51d76cc6d7f050c12ab61fac4694d88bb0742229f05fcb25956bf5ac72ae1457a1b51216926e398c0c5a8ae8b3299baa2193f57cbef605a357bdafe93c5c8ccfa9d40e510952a5d7d18028e6aca222ff09b73fece666e2ac4acb5b823c4e1e4c7574ae082ab6a94c5294c8d0d08bad165d643540466ba109bd0c37f618a1f25eed32cf6ae14805f2373c6dd7fdf9b59231cee1fd73571a1cdb7157270fb44b50927d36473887fa8befaa2daf81f700ce2a4342186657806bb945325d863d692578636fd3c120f6db17c8bb9846272a519dd03df676d1e667d05d39661ae7a53fa8f37f526e9a9eb462102bf83bce6ceb82e780afc84642c3ad643efdca373166ac9c2133840ca65bae9bf46d2b1fcd12ad8bf76069a9ac88c25d89aee381be3fc4ba66bbc6156fb90864c9e415ba183443fe8e65447d8d4c1cd096241cb4cefedef007819cee686f98317bdff6bc0064fe295fea818943cec9e26a95d8517c9f450c99a7730f1d38dcf587c81708ad489eaaf8d1d1416d41a054488b09a6a17b87e2763037d098d805c7f40f674c5f2fb331fbea00c94da069abd178c1b65cd3a7a9736c30e31bd9fea0aa30febab81c1beafc16bf598bf2f65ad424e91d629ee47a44015238f5929e15437c2e950555379eef9ec948eab1e8131d6d84a82ee636ea6ea9466702469138d1761ef3afe9b38b77a6901525275bd96ce9d529b13878baf5f3588d65eed4ffe3375a1df1ecf5ce4949a216d3763d88f9ab54838fff9416732ee01c860a72f47a1eef4abbe080e8d2f7b5e4f695ff6e04664d961c66d357da8a8875ef45a97dafa5eaa5547c297e15e55d6ea2e5105d7143e7a7db524c5ae027ead25a7e74e98eb12aa0dd2d1377268a074e24a2a4d2a20a762b604efda0b19b301add79ac3b3d0ba4a550c30f8d5f25364d73f095a5a1306be40bf8f3b192f54cb6a12f3082827e2af4b5669ae79669d3238f56955a32e67f0d073d90b9e326dd6895de87bf3ba4a09623cff319ca9a6cf342b29ed60b6c1e10f3f28806f9c0e6df3b21ee45fb0b673a4a60b518e7d1f06083ddc7e86fd12a5a443256e9d2b02e9a9114c17988eee0e5e7db7bbac36c5ad8f91f24074d6974b3436a4065921a6aa8e1eb4ef9114fd28ed52dcfc20ce9f0c6845657bc5a8506847a64d3f04b419254a958b61b664024aa81af4e53f7a2c0cb399cb9e87b79dd2c1c01084aa1a9e1f3ba418114ca9c63a4ca88ee33cb59d1876b1cdc0e887232e8e0a1d77a22fcaf66f73d177eb6b7b48e6fb43d7c160608cd66fa4a325f59c073942fc3070efc139ead0c22018597fc7c58fa2243ac148e80757b01ab185acf9783fa63248f1968e06c5c5c2d2249ef2c4595d8998bc4783aaa4622d03a455b4201bba27959f26b05db487a92e572a86d40a73473e10a9a248f94cdbfceccc1c41de21a288528b51c3a828e72295e9be276601d53008219aa8d877f959e61fc5374dc55cfbc15a5407b973477737c0e7a087b0930046b53555aca0e5c5695e801750c083e7b5351031d259f29327988a66e2de05ba6db56b77bf53213053b79e5e2fa5a4457503026ba1e8c9d2fc597cf0901cf519453b0b579f7ca7ac02f1ff3a45e9f6152bb765781ee01461d67bcfec9618aba71e8d1960ce6ab2be5045dd0f5430c17f69e7bf8031067f9d84a0f14efbdadd8ec5c5ac673bd6993556d4fd7dea555027b86f6d90eea54905c430bacb4a76189ae86579d93012efe2798755f7b33369a24bbef45b446716febeeeabc05114901ae804fdef660fe2bc34166b4663468c7793dc13b53b027402df9b1772aa8c9a082584c3462cfdcb158a86b9310071a0079ddfabf890546ab4a4ef8101377f6105a2918e7f30a7d4fd3918cf27c907202f0eb4a8e7739100967cdd022622a24f0106bb3d4d0d51dfefa5cc3ccd8c517b31bc565f7dc3d7ebaf1f61161c16ea52da0a2292945de25da069488db395967616bfefc92a0c8e0ebca92adf51174209c4b5371fabde9aa6bcb13fc37539d61c5fc044d8afeb302016c09bedf703396f3cac769b584ccf8d363b5661b25e8084f72de501507f4c2342fb9120a50bcd9205c4d0e51f5dae8dd128f2bfc4e9c1194765dfd5edaba8fe5b5ec26d503a8bf5c902d79463ffe88d0b9ac527eebc82847fdb22eeceb186273c3bfcdcfbe888804dbf7ce36a6556b3faafd8145618ddd58b9fb48a890beed0efb47c4a128f8a095c4e21894f5bbe570e0a580f9dbc5e15012c52ee4306d9d52c27c0ecda9a104631d9b0fca2334e8eec62981fe047c52aa18c577ee575f47374d864f4a2cf6182845357fe38f4bd30d1cfe49963e172e613355e2a4b08a459956051e814642897bccbf54576cbf254781a2a4230129a29bffac568f205d02dcd553ba6a6533f9189152cbb97020c6074cd5ef91c9da77fe43faee13c4115a18a90b847f2ce5499ca33393da0cd27f82534fbcc658f02e3bdbd2a4904007110644df7de56dd946837d57e40a3575d664ea03cd1c280fc0b5eb0c258c56a7f8612ac8c1323c89a114a4487892aa44bbb7e103879c75139b039bd2d0cd110af5b782a69a45ecd3178bef1198dbb9bfbd149760973fe46f82c551a437cceb771bd16fdb51961b14c78fd0529425552e8950a43930650202687d90dec6638a4a8516d87790bca6de2cd5025509eaae34109fefb9295f4146f681f63fe4f8f8c5f71d4c151e5d0e2437889a5c3dd5af3dca193ae3078b11c8558a57074dcb808cb88d0551d5064d2619b307a371376", 0x1000}, {&(0x7f0000001240)="d39a910932f8cf714ddf75a97f6eeebc7fd6e37b1007ef828907d2433f1e9fb60ad21d6bdc89446a59b9fc63492fdbe3a250144ce3a899c799f5ddd6279ea62ec1a3116d182dfaf4297bad2d2cd4777426e98e33d5fbf038b7d44c1ba495f7b6c2690d3e72a44d923e3045d80977c78eb71031de8595e33f7409a24d69809e81846ae92e8d20e679dd9ec60639639a572f0ce45aae8a3bc12f2dafa67cb7447d58db25a4d6e335cb531ff4f7f4db7924d106208eefd9a1744755f057cb8e58a200469bd023a7426e6d04b0daaa99b330bd7a46a4247f1dccb741ed4daa4de46e7b2dd1eea12ef745a4dc9406e434c809c9539b0a12c262b631566d17100797b7eb6975fd9829fd022888f81d896ab75999378e34d9937a54c4a5dead9e3c9fc08b646f475d82ee03b7e7311e4be37834165bbb31d0042001364fff732f3b8353fdcc92445f7ed158c15e5dcfdbf8cb7483fd4ab7c158be8309553745303935eb4285e3abd17d7bd47766b6885dba3682467ab0000dc73e18c5786de6a63070edc2b2dc966d8778a0fc9f53a64ddb9002ce7c483f0b21881e4e5bde6a5d96cae8f86cdda6daaa959a72f1857510fc3e5729e4ef496c71f5800fdba91e9c3f97f8350980e7e02889da317461c2687be9d0cd6aeafa9d541f005f86926b75a66afda7c7ee45ea1dab73e7fabebc051c0bfa6b3147329feda6f54bce1ee958cccad24c5c5aeb2b39493cc31dbca5bbb959043f64743f6b7af74d287927a300ca74b5552bcc834848fc99b7c2f56d3afeae7481dc4a3f29a0fb77a87bc58c1128850ce347d36d4e555cc672ab2cb77cfac454a91b1df717c11a02d2f872d413c0b99e0f15067caf90c90c637effb7b31ff5b5c12500f3b2c0ff04dc49a9f5a7fc70415463e68c8a523298d1c2dcb6158213123dd7ffc03f074e1295d9767b45f40a52a6dfe9616c0516b29afc890a3ed50bf0d2869fb3a2cae34d6fbe0d2a0a08b200c0372362eeba0434b055b4b29563cd4f0866e8057cc367fde4d4c1cb4306fc6e3bb699781a83cefc9e258dcbce10fd9a0a8c219ccf26dedaa096a13a744a9963d691d51d16d5b9fa153fc612c5d2f19bd96deb4ac4ccad9191b4758833145b5a4bda3598e6ade96451d853d13cb4fa31309bd0f1026615b3dba510a0bb1e6c29a152caec6e21e6a0533d82a9c0d9324f5f7e51e62fb00b8d1cdfc23cbf13b2afbd1e19b62114c4438aca15fb3ecb1a52d59d4adf1029e58eb1412c9ef452df8119316d5d76a1c3b7eb0e67f5d92031879c0f95b691aa5368e7d1360bf299d511dfd01b5f3e105f0f71f3a9517310688e4ff097aab92b892007d141ba4474c14d76b53170301d9f5bb325476ae5418bf87a703730292cd2c9ac1e3c5ae205509002e5fd558df564649d377b0ea7d408cbea84f6a599a3a21c587d90ea6299f8f506e832fc4765c051cc260cb237b2a1c348c5da428e0b55c9d6be5e62525ccb26a55954cb724ea7df05f377dd031de528c435d5d3ed06ad48ebe343c978a7b2a2f91ee0bb0eaed9fcae996116bcc619d85ae8856ada1416316e7226db758aac7fabba697d1f79edcfabd8857ef51818f114325d84311962ecbcb26e16c5b2806f7ea22193280cc39c51a6af669ca2c6615e637097fe71186c33b09a781e5e2c14ce707ce30bee70c6141389b205b6ed7f2cfdc8322058133208e3c7bc122caf78a4566d463b8337ed9e0789f4d93a29827377a8e43130217ca55d1bef675682df5c60fdc1825bc4a48c88d451dcf6188e6701a53c5ddc07fa3d13b2c003b126afabd4e563aab0553c18e287cfbf6d89cb7ca69bd5c62bb33010d95017bbe9b361fa6b27c8fc923f061e8a71f3c520acd38c8d5fd18fda4b8bb3c7bfbae3008b20df5dadef56bb024c6e78af12d97542bc2e1abbafe2ed89799350d4d660552aef6930069b3f930e2c713485ebad672685ec97042e49cd0a7f832160b893517363cc49ca44311a7eb3c51083aacbc0e4b10a4f9423f93dc09e4261466a8508cc68b32850dfb8e5116ca9b5595a5250ad8b922057ac94177b8da6d75048c6b865ab9d46b3ea47e49b9efd1ede06872d7f8515ee367d702012e82fcba57d47b8bb43b4e0d51f85f5e70d8a0d53f40f98de1feff1178e6cd6c4ab75c393c6ebb208f85f8360e34dbdec78ede66526d06c3f75a0437e9f8e34d05d0e599ccc4381ba0080ae17cbf3668667565743365946e22ed2329c51f5cf5ceb255ae554f916b1aeb989e3edc6f33ee9c32fd6668eeccc76a4d6024792f9d75bc9fe6211abd26b49a460160315a23f55a09f030b88011873b5447294a7955ce5eacf96d747788dcbdf4062777cf1ad1072fbfe64d6787a3798a11cb74adf63699709d9fb527d62ded0eb0aa3d1d33a6e37a47703319fe1265139922af3cf1680decf90cfe4fecf5946fc9d772581e627652b564661dea979defbcae503a9d158506b35a3b9089dfd2736815e8933bd638fde32411f0e1a19a72577d3909d611abe248672533badac906bd5237ddd9cd9bffe76997dd93235f527b6813c60eff45bb5a3785280e4e3cb0d89ba23c6226f64974e75066d032d77299249fb15e22bc47146aa8cdb263e8fcff41fadba74e974f9acc24a11a519af5ec640c9ceed7cfc75efd917b49c784a893aadf7e835f03d51ce227e359de7f03f36dd2fc8d34f2ff0b7bef43c6213dfdd0d6f27e69c7b6f5cc25cf8f34c1a593f11f151c87c61d732b5e26562985995469173734c2bd1e1471bb371943a90f88c9aec915b4dcdbf0b7ad8595c8e4a5757d5d2bd02fb88b463bb3e360b84bbf14a2be74530006a48c6e4e997d44275c3a83ffbff825d9668d41600639ebaa84cbc5a7b9c49d2ffc5d649b74aeb77ce42f70430b9a20a0bcf187fd8c201c740cde8176a3af86a42b00f473c51e285d07ba912fd66d8feed133abc2aa5d105f9d2018afada35ae513a0914952ec1b0b80d4d48173ee3226d38186555436afb1530a65e60f57165e9ad08c098755309049d104213feb546db62629cc04557293cbbc929c9e2c745434ad91d11a338361e95070b2944b62f29a773271005d76a35457b2e023e84d2c1d655b0bc72aaa205a43c2cd8e590b24090ad9844cf32d93c30988d246c4ba8f4d04458c785dcdedef10f90b08fd0b0ed6dc21702d972cf448fc9ec7c6719e7e6574b3b03b7c4d664fc53c1a8d8f2407365472bba61110cdb17e0608ada62ebf59f42cf687dc57c8a93575f2c4fd6b80aa33cd97b562b12c807d521f7ffcf22e8db60e764d7925a0d3d6a5f3deb2120d06e0655a91bfb5c63cb458e16a738314f5948dd763342cf2d305460132e98983d306c4b33a448db58dd8521d8b59ffee091be8ab891f0178c8005cadb3e924a25e823a13d71a788ff2c53927f74eeaaa29105daee40293bf54945834c8f0437a9da994f237fa766ae472850073e27e2f49aee1eb4ec2b16fa04399adcbcb26d47ba8217fbcd18c351646a7df5a6d20caeb57f87b0f86bab24c66a45850ca23be5459e67d7fd23c4ce1e27edbf78621fe0de24810c3f3c85ae219c381463039557421aa734f703de2fa40e451371555317a51b29911dfa6ba121a853d3d70534cd3cbbf641fdb75675172e43f0879da377161d1432d7e5766920dca7defafb58d64c969e1e6f5c4e4c576952a56dec8c689752f0ec7d5d711f0b0b418e9804cf9a236f494114edea1ce98bd0fc5d00975d137a24961f1b171d4fe1b5da7bbfabcdf810974db95831e574986f05d4a9d5fb342f60f320f67704a83e51f85773dbbddc4d3080c046230df6d43f5e813e5671b3ef2f7ee5305f74fb8f408fea61941b0c0044611fe74046a1639a904d229c1b4f7b1a8c4ed71d6062a67d7babedae6e115140cd0722a866edf034284d51e586bf62b00b0f33415ad62a513176a78cc753053586e3aa71ca2a509f779935c46bacf2d61ade9909836cd0e62aa32395e4c53e5ff8c3f6379b39afcdc01e7ff9051294837c1edb964784a7ded3c1388a11392d20eea4a62905330d580ef8e1e1af21889955e345c04a9f19112a97ad60f2afc20d52fe8a3888ff6c951bf184fa6fdcf3d8c60791787e7348b71fd2150b3b9aedf57bc131e31ef271d8b4aa9da8862ee0756ee014656e50d4d55b27f47943028ad87bef7c5942493755f93089c23406bac464c28f73546156e86ef6197b87deff23d3c7c0883cf91c68f52ee84226d997b9d5523774c14c6b3fd8229847843ef1b98c34d7d649b4f425f16a558f3f74eb4080f64218f2ac713cc32d84fbc01f0e8630b376e1888227319059589b26b571ba21b1f9a47604c42c5b2a077d7fedc4eda432a2eb6eede9c68cfdafd24b644cee58646f1afe067f34d9625a643fa3796b809fe2aab56f72675635e0186935ba39602a29544ba26b22bc128e3924cac8bc9159c2756459e52c827febc5060dd9542a4c692b5a3153406d212551362ad234d57e5d0690acb7393ebc768d2159af1fcc60389b04fb9a50d3af0273f41dccffe4cb2e60bdd7a2794348b35d1096f27756d9609c654e8ac5edfdff23e5a44ffbd852adac5cdf3153456f8e778f02029542eededdd81daef6e3b5dab63b3771e5722d831ce85abc701481f8947cb49ee5d982abdb7f8806ed7d6445136c8da56b00c71a4f0ec6ecd0be0183f6afaf4e8c6b6013eadc18c3b61cf2ed73a827f9d2d909f23f45d99e557a7ec622ccfb08503c7b4f034d146b657279ac1ee39da419f57b0cd508ee3aa7822b48e023a154857bb3e03d80dfc1a4ddfdc2a86b6e6a411d0a9bf47e9b41e3bbf2d6f9e516a1e39b2a6345e1353f10d0a615cf8b446dd2182084056509fe135eec1b2a63cbad4e52b115a58b378a8afa774787c74e7a9dc3728a3ece1254a849b491b2957cb721e3298c7900d6e9cd11f1a9a60dd3a34475e111e89cd1e4a6b771f86effd87c160369cb2b20a59751265b7aca117df77d5774d2fcd04af663a1815d60e41cace0c58792f26cbd30189709fb3c96068d1ad456dcee24b6ddff1e06277a1a2652092e903a6fb165ae5ac7d77d0bd4aed221532be850e3f981b8e50534134d40e0ce25107db48cb119777813c54b60beb49485135299b7423a5dcfc709ec92cfdd25103893fe81792afed40727080032278438f29469c0a71051fd3599e85ddc298cf316af12f843c79c0dc26f56e7a90445153d15d132cbfccc0d7f786033d733c637873a820ce53ed876b9515acedd372dee355bca14fd9fe0c0db8fb0bd8288dac8ecc7d5e03a3410bbd7eeb57c5e39487ba59ef1d2e6036c4cfcb6b0b3e727cd91df0d6c1aef1151c7ddc32e99d20c5295606f5bd8d7dfd60e9de89b23c19cc4de8f0fd7f86a9ac913a3f4527eb11b90abf3e84fca0e3773614b660bd2887ee4f334f2413caf7ccbfd1e2a0c1f6a222a5bdc3d974fe3b8f4c9554f0d0dd74414103109c16e92f0656ebfbb6f4bbe2553fba92c660e48222df970a74200ffa38e1730eed221bd30b8c115db757a383adeec2b88a2c56e4ae80058fdd7b74ebe92e44bdc7182835d2c43eaa8421056af0295e556f5ec9799421bd4e43c51effa40c1654063e69d306e46ba9e5cfdd7f12841435c4270468dc004be9a75fc2362b3e1cf73dbaad5a17cde8283fa1f28c3a5e464e14670221def0291d0d3cc1d41d472deea802612f6d31262cb41f521b93fee15e572751903703ee20827fa47215f03ab05fb926262d94d5524b0ea9d5e5f3768cedde94c13e47ea5558acf35d3feba376ce926", 0x1000}], 0x2, 0x8111, 0x2) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:03 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000250002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:03 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0x0, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:03 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1330.124859][T25082] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1330.126711][T25073] EXT4-fs (loop5): inodes count not valid: 620757024 vs 32 [ 1330.198391][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1330.218546][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:14:03 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000270002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1330.237433][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1330.251852][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1330.273131][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1330.286768][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1330.299499][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1330.318548][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1330.356459][T25098] EXT4-fs (loop5): inodes count not valid: 654311456 vs 32 [ 1330.368064][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1330.381147][T25082] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:03 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000002e0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:03 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x2) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) prctl$PR_GET_KEEPCAPS(0x7) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1330.563749][T25106] EXT4-fs (loop5): inodes count not valid: 771751968 vs 32 11:14:03 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000320002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:03 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x23b, 0x0, 0x0, 0x0) [ 1330.734979][T25124] EXT4-fs (loop5): inodes count not valid: 838860832 vs 32 11:14:03 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000003d0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1330.914990][T25129] EXT4-fs (loop5): inodes count not valid: 1023410208 vs 32 11:14:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:06 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x0, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:06 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x100000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000340)={0x4, &(0x7f0000000300)=[{0xff, 0x1, 0x80, 0x5}, {0x400, 0x0, 0x8}, {0x5cc, 0x6, 0xcd, 0x5}, {0x800, 0x8, 0x6b}]}) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x9, 0x20}, &(0x7f0000000100)=0xc) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000240)={r4, @in={{0x2, 0x4e24, @local}}, 0x1000, 0x9, 0x8, 0x7fffffff, 0xc220c21457953d69, 0x1, 0x1}, &(0x7f0000000180)=0x9c) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000480002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:06 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x23c, 0x0, 0x0, 0x0) 11:14:06 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1333.180361][T25159] EXT4-fs (loop5): inodes count not valid: 1207959584 vs 32 [ 1333.207010][T25162] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000004a0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1333.290485][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1333.304064][T25188] EXT4-fs (loop5): inodes count not valid: 1241514016 vs 32 [ 1333.316227][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:14:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:06 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdc, 0x200, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x7, 0x967}, 0x0, 0x8000000000000, 0x4000000, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x7) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0xe501, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000100)={0x0, 0x3, 0x30, 0x8, 0xfffffffffffffffb}, &(0x7f0000000180)=0x18) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00000002c0)=@sack_info={r5, 0x6, 0xffff}, &(0x7f0000000300)=0xc) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, &(0x7f0000000240)={{0x2, 0x0, 0x1, 0x3, 0x8}, 0x57ba, 0x8}) [ 1333.332985][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1333.353198][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1333.371258][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1333.383749][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 11:14:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000004b0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1333.412740][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1333.441341][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1333.457529][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1333.470663][T25162] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000004c0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1333.558071][T25212] EXT4-fs (loop5): inodes count not valid: 1258291232 vs 32 [ 1333.712734][T25220] EXT4-fs (loop5): inodes count not valid: 1275068448 vs 32 11:14:06 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x23d, 0x0, 0x0, 0x0) 11:14:06 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) ftruncate(r4, 0x9) close(0xffffffffffffffff) r5 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) r6 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000980)='/dev/bsg\x00', 0x101001, 0x0) r7 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r9, 0x40305829, &(0x7f0000000040)) close(r9) io_submit(0x0, 0xa, &(0x7f0000000b80)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x3, 0x6, r1, &(0x7f0000000380)="dfeef784277ecad9d4d12a15509350411ada910a67cf013eb301353649cf2c011d8fcfa35e32682401535c2f355d0acaeabef9cd06c832539108206dbcd93417586e9dde035078af409964e0c3c294f52ffa5949a302c33197f9f2f481c98f1baeec20b82b9eb1b1871c71ccee077abaa78151ce0fb551024a6c7226440fd0e615466c2f5768c289a880e9c1d40698de46ebdd3c785bd3953df6bc25aa5e39b16a0792497b90f156e20c27baca2d5c3b4beceab701726ab375153295d9aeeb72a20891758c4f514412fdf94c359daa5d948b5501bc4f7e4d404058fe6354593825", 0xe1, 0x100, 0x0, 0x1}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x3, 0x1ff, 0xffffffffffffffff, &(0x7f0000000480)="b10ecdd3e557bb6e8c6e1b091f4d3ac349bc04f953fd4a8e012b9eacee9044f86824c469b6733e112cc5633fe3e1eb076e3fbd5d20afa7bb5313b278d97b00a128cf50eb98673024c2b154a93d4d1f2f0a1380f0eceef93c858f0098b0ce5bc6c43952db4acea0a054a96b12599811a2960a1e8b96618a01685022ae8ab659f2f38f4c222ef0b288a30413ab946b4221c6dc86303b1beea5467ffa2e417199aceaf1b191dd974766951987818c152f81eea6c92d517db209df788f052f7d4e3b3aa76776aa9b98fccd354d824fffb19396ca89e6579d8554be67e5d8ff", 0xdd, 0x8, 0x0, 0x2}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0xd, 0x1000, r4, &(0x7f0000000580)="4ac5f74ea354cd536a856770290d03eccd9d79f3efb272380df17d6173388144491e2e998f59ea56aa9b618ef78d", 0x2e, 0x1fbf, 0x0, 0x3}, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x6, 0x2, r0, &(0x7f0000000600)="3bf3fbfe50be8c7566009dc7f84587eab02f72ae3a3f86107756d5f00db9c7970d3da56c67c0435b06e6b889e2492d2488216bf27f5750821aa330c5eaec983d3e4d7859a3c66c68e7ce66939d73cc700e639218a8628fc670a42ad16d6532f16b", 0x61, 0x7a6, 0x0, 0x3}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, &(0x7f00000006c0)="ad516a653fef5056a86236b65dfbec1d933a1cb055575a0fa5d9f72ba7c4a157cee01e7b0e3312def5e6520dd3d7ef074945c7f1801566c6ca16c7207a12d700ed868c9d637f83e26c2f01edaf30c1ae38633448c47c28b3a104b748488c07bd1a6b83a3f3ce1904eb2a11a03f03cb01edf0b64c9f6cdcd18f948da9b7a49ac559e73d669ae9e7ff82892ce1b21de7a8540993e51902eee41eca5273", 0x9c, 0x1, 0x0, 0x1}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x3, 0x40, r5, &(0x7f00000007c0)="d14147a9c0e1d1163c78f5382468d6afc7d76ab2afea4c94091cd167bc04a7c58b4f1c21834438ef6a", 0x29, 0x6, 0x0, 0x2}, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x3, 0x0, r4, &(0x7f0000000840)="e65a78d5525c35cdb48d2a37d7d4bc0ed6e134800e8f09b56fbb06bcb732c41ff70e28c530e0ea36662ae9fd7f0138af585d9b84de4b91a6c8e0942017407e3d53e4b112bf1a14386c56cbf62ae5d5fd036bf290c37368e06b89ac88bcafbab3123198f34a0141d8b9d2c864e8ed0327c77c1361deff205b0d5e6bc1196f4484771b957176cec3ed7acc9cf0dfc7c8468a5d27a253fb38eac465376ead14cce56a5b89219ae4b1c95b07a1a5291efc83aa18", 0xb2, 0x0, 0x0, 0x2}, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x5, 0x401, r4, &(0x7f0000000940)="b186d30f", 0x4, 0x9, 0x0, 0x3, r6}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x3, 0x0, r7, &(0x7f0000000a00)="d899e79a887ea039b8af5b5666d00adca279a57a19478cfc1499f4c416b204fa7d2ed1fb69de438a8dbdfde6db60ecaacf0068b48166", 0x36, 0xffff, 0x0, 0x1}, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x1, 0x1, r8, &(0x7f0000000a80)="b6f20ef589bf437e0a71252bf7605faa486458bcc6e0a1837f7d65363ab64d915cdf54402f84e8324a59a638468e53d6a40f6362dd6fc6b7c57939ed8c6309f50c8b6de230abaf31ec4dafd1422e7f8f67f37c8663f18d21345d3fe4a538bd0989a899bbdb95cd5c1909ab6936f27252adbf06e2e75707ee5181600a059e4afe465e1832b9fa4610562fff", 0x8b, 0x1ff, 0x0, 0x1, r9}]) 11:14:06 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x0, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000005c0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1333.897694][T25228] EXT4-fs (loop5): inodes count not valid: 1543503904 vs 32 [ 1333.950431][T25241] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1333.992123][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1334.034132][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1334.102547][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1334.122588][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1334.145570][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1334.176790][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1334.209051][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1334.239163][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1334.253136][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1334.265811][T25241] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:09 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:09 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000600002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:09 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x23e, 0x0, 0x0, 0x0) 11:14:09 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) mount$9p_rdma(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x800000, &(0x7f0000000240)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@rq={'rq', 0x3d, 0x7}}, {@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0x200}}], [{@defcontext={'defcontext', 0x3d, 'user_u'}}, {@seclabel='seclabel'}]}}) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1336.302760][T25271] EXT4-fs (loop5): inodes count not valid: 1610612768 vs 32 11:14:09 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:09 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x0, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:09 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x10000000}, &(0x7f0000ffe000/0x1000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:09 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000680002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1336.515778][T25301] EXT4-fs (loop5): inodes count not valid: 1744830496 vs 32 [ 1336.523565][T25292] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:09 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000006c0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1336.569601][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1336.654381][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1336.698902][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1336.731039][T25316] EXT4-fs (loop5): inodes count not valid: 1811939360 vs 32 [ 1336.740421][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1336.770127][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:14:09 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000740002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1336.843819][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 11:14:09 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1802, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x40, 0x1}, 0x4010}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1336.884174][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 11:14:09 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x23f, 0x0, 0x0, 0x0) [ 1336.923735][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1336.974578][T25329] EXT4-fs (loop5): inodes count not valid: 1946157088 vs 32 [ 1337.043676][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1337.081249][T25292] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:12 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:12 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_setup(0x87, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r6 = syz_mount_image$ubifs(&(0x7f0000000100)='ubifs\x00', &(0x7f0000000180)='./file0\x00', 0x800, 0x1, &(0x7f00000002c0)=[{&(0x7f0000000240)="0c41a7958a122f00adf1f2480a52fcf441ea933e77c9b45d06a90ebd7d9e4c145f681529058578faf59ee35378952ec5fe234b8b8959068be5e85386548192a92d4bf11c42bac4f0a16281da6e0dbbe06c93579c5e586da635c728af253346db531aa25b0e816f0ad54337b8ba5e", 0x6e, 0x7}], 0x400, &(0x7f0000000300)={[{@no_chk_data_crc='no_chk_data_crc'}, {@norm_unmount='norm_unmount'}, {@no_bulk_read='no_bulk_read'}], [{@dont_measure='dont_measure'}]}) unlinkat(r6, &(0x7f0000000340)='./file0\x00', 0x200) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:12 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x240, 0x0, 0x0, 0x0) 11:14:12 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000750002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1339.357603][T25366] EXT4-fs (loop5): inodes count not valid: 1962934304 vs 32 11:14:12 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:12 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:12 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x241, 0x0, 0x0, 0x0) 11:14:12 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000007a0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1339.387241][T25360] UBIFS error (pid: 25360): cannot open "/dev/loop0", error -22 [ 1339.537300][T25383] UBIFS error (pid: 25383): cannot open "/dev/loop0", error -22 [ 1339.581868][T25398] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:12 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x73, 0x0, 0x0, 0x0, 0x84120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1339.625741][T25401] EXT4-fs (loop5): inodes count not valid: 2046820384 vs 32 [ 1339.642147][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:14:12 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x242, 0x0, 0x0, 0x0) [ 1339.707662][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1339.747968][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:14:12 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000007e0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1339.788394][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1339.818770][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:14:12 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)=""/140, 0x8c}, {&(0x7f0000000300)=""/179, 0xb3}, {&(0x7f00000003c0)=""/179, 0xb3}], 0x3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1339.843102][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1339.863521][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1339.893638][T25435] EXT4-fs (loop5): inodes count not valid: 2113929248 vs 32 [ 1339.924622][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1339.943675][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1339.993143][T25398] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:15 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:15 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x243, 0x0, 0x0, 0x0) 11:14:15 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000900002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:15 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x3f7b, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x7f, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) ioctl$ASHMEM_PURGE_ALL_CACHES(r4, 0x770a, 0x0) [ 1342.377188][T25472] EXT4-fs (loop5): inodes count not valid: 2415919136 vs 32 11:14:15 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:15 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:15 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000cb0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:15 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:15 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x5}, 0x0, 0x0, 0x0, 0x6, 0x0, 0x6}, 0x0, 0xf, 0xffffffffffffffff, 0x1) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40305829, &(0x7f0000000040)) close(r4) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f00000002c0)=ANY=[@ANYBLOB="04004c0a37907e413e589a1f24cf8fec0000010101000000030076cfc811f1fc5a84c3808731afc6183ea94b0f97ea0633d45c8aa4ad1599a1d29405ecabf7019419b823441603cae6ed172e88d0cd"], &(0x7f0000000280)=0xc) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(0xffffffffffffffff, 0x942e, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000000)={@empty}, &(0x7f0000000180)=0x14) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1342.630623][T25491] EXT4-fs (loop5): inodes count not valid: 3405774880 vs 32 11:14:15 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:15 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x244, 0x0, 0x0, 0x0) [ 1342.676918][T25492] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:15 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000cc0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1342.841171][T25530] EXT4-fs (loop5): inodes count not valid: 3422552096 vs 32 11:14:18 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:18 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:18 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 11:14:18 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={&(0x7f0000000000)=[0xe10, 0xff, 0x4, 0xb379, 0x9, 0x4d, 0xffffffff], 0x7, 0x0, 0x0, 0xffffffffffffffff}) fspick(r4, &(0x7f0000000180)='./file0\x00', 0x1) 11:14:18 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000cd0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:18 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x245, 0x0, 0x0, 0x0) 11:14:18 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 11:14:18 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) [ 1345.404939][T25554] EXT4-fs (loop5): inodes count not valid: 3439329312 vs 32 11:14:18 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000ce0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1345.478926][T25555] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:18 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:18 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:18 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1345.643006][T25585] EXT4-fs (loop5): inodes count not valid: 3456106528 vs 32 [ 1345.728267][T25591] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1345.754399][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1345.770312][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1345.783278][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1345.795590][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1345.807901][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1345.821134][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1345.835099][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1345.849409][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1345.864041][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1345.876481][T25591] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:21 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305829, &(0x7f0000000040)) close(r1) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x200) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000000)={0x3, 0xc8, &(0x7f0000000240)="1f9b7e1360d110618752696976f033e265999801f8a738a9d4bb0b230a722f4e8784c111134d2349b47898350856ad14c2a1a62df46c98d89245b7bc9e55c22d3f6bcfc3237446276bcee434e75c46c18c991df9443af0d25630cbe6173b7593734b3edf30e5b374fdf030ac3b3db58a868d1303ad7376ae76cc1b1ed06d971c284bb942c7604a1da0eb3075f8a8baa0f1862e1a3c6cf85e9a06683851e454128680b94de76bcd8dc2f327dc4042c4148b6681b84614523b101f63e12678cb26cb44576691b5a332"}) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:21 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:21 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000cf0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:21 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:21 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:21 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x246, 0x0, 0x0, 0x0) 11:14:21 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000fc0002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1348.448454][T25621] EXT4-fs (loop5): inodes count not valid: 3472883744 vs 32 11:14:21 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1348.523923][T25638] EXT4-fs (loop5): inodes count not valid: 4227858464 vs 32 [ 1348.545532][T25623] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:21 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000040202000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:21 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x3, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1348.669210][T25648] ptrace attach of "/root/syz-executor.2"[25647] was attempted by "/root/syz-executor.2"[25648] 11:14:21 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1348.758260][T25650] EXT4-fs (loop5): bad geometry: block count 514 exceeds size of device (512 blocks) 11:14:21 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x247, 0x0, 0x0, 0x0) 11:14:21 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = socket$inet6(0xa, 0x0, 0x80000001) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x29, 0x4f, 0x7, 0x9ee, 0x48, @rand_addr=' \x01\x00', @remote, 0x80, 0x8, 0x10001, 0x6}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r5 = dup(0xffffffffffffffff) getsockopt$inet6_tcp_int(r5, 0x6, 0x1, &(0x7f0000000100), &(0x7f0000000180)=0x4) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1348.846550][T25662] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1348.869088][T25669] ptrace attach of "/root/syz-executor.2"[25667] was attempted by "/root/syz-executor.2"[25669] [ 1348.907582][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1348.936294][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1348.973947][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1349.020607][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1349.059525][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1349.122702][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1349.142682][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1349.163757][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1349.182102][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1349.201618][T25662] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:24 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:24 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:24 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000060202000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:24 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x248, 0x0, 0x0, 0x0) 11:14:24 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0x400086) close(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40305829, &(0x7f0000000040)) close(r2) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r3, &(0x7f0000000200), 0x400086) close(r3) setsockopt$PNPIPE_ENCAP(r3, 0x113, 0x1, &(0x7f0000000000), 0x4) r4 = syz_io_uring_setup(0x7b8a, &(0x7f0000000280), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d6000/0x2000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r4, 0x450c, 0x3a, 0x0, 0x0, 0x0) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x900, 0x0) getsockopt$inet_mreq(r7, 0x0, 0x20, &(0x7f0000000180)={@empty, @multicast1}, &(0x7f0000000240)=0x8) 11:14:24 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x150, 0x0, r2, [{{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x150) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1351.510342][T25715] ptrace attach of "/root/syz-executor.2"[25713] was attempted by "/root/syz-executor.2"[25715] [ 1351.528137][T25708] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1351.542593][T25712] EXT4-fs (loop5): bad geometry: block count 514 exceeds size of device (512 blocks) 11:14:24 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1351.557336][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1351.586595][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1351.614289][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:14:24 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x249, 0x0, 0x0, 0x0) 11:14:24 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000350202000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1351.662567][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1351.721190][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:14:24 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1351.784278][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1351.845170][T25750] EXT4-fs (loop5): bad geometry: block count 514 exceeds size of device (512 blocks) [ 1351.847618][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1351.867389][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1351.883831][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 11:14:24 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) ioctl$PPPIOCGCHAN(r4, 0x80047437, &(0x7f0000000000)) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:24 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000600202000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1351.966839][T25708] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1352.128894][T25767] EXT4-fs (loop5): bad geometry: block count 514 exceeds size of device (512 blocks) 11:14:27 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:27 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x24a, 0x0, 0x0, 0x0) 11:14:27 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:27 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000302000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:27 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) timerfd_gettime(r4, &(0x7f0000000000)) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:27 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x150, 0x0, r2, [{{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x150) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:27 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1354.544266][T25789] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1354.577549][T25798] EXT4-fs (loop5): bad geometry: block count 515 exceeds size of device (512 blocks) 11:14:27 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1354.610299][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:14:27 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1354.674318][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1354.686948][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1354.709459][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:14:27 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x24b, 0x0, 0x0, 0x0) 11:14:27 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x40200, 0x0) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000003080)='/dev/vcsa\x00', 0x0, 0x0) bind$vsock_stream(r1, &(0x7f00000030c0)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600)='nl80211\x00') sendmsg$NL80211_CMD_DEL_PMKSA(r1, &(0x7f0000000700)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x74, r5, 0x2, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x13}, @NL80211_ATTR_PMK={0x14, 0xfe, "0432842af5161bdfd25a87e3cf620f3b"}, @NL80211_ATTR_PMKID={0x14, 0x55, "ab9158a6efad9b252261c361bf22bca7"}, @NL80211_ATTR_MAC={0xa, 0x6, @random="6b180581b13e"}, @NL80211_ATTR_FILS_CACHE_ID={0x6}, @NL80211_ATTR_PMK={0x14, 0xfe, "f5ea66c540d179a28d6664258c060869"}]}, 0x74}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40305829, &(0x7f0000000040)) close(r6) ioctl$KVM_GET_DIRTY_LOG(r6, 0x4010ae42, &(0x7f0000000580)={0x1fe, 0x0, &(0x7f0000ee7000/0x2000)=nil}) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x49, 0x3, &(0x7f0000000400)=[{&(0x7f0000000240)="0f6c6ae940ef0a64c66e3106b8e0fd97970968714e8b18bafc442d29d08c89b33dfa96f5ac81fb4d28b16a96734e97a6d29d2a21287a105fe679ddac7a65646bf6d1c5ebdbc887f02ff1068a29666e", 0x4f, 0x80}, {&(0x7f00000002c0)="bb940986b70068cf5fb6e590a17a0ba6723868242c022085f3d704265e1168227c2eedbddf64cbb3ba3cefe48fe9f4245725f6909a70181f59dbed5649b95ee4c9796820e9a347a6a27cf338de8be631b9c8", 0x52, 0xb9e9}, {&(0x7f0000000340)="a08e46708d41ead879e945ed5aa5786f8bcd3d6ebaa99b04ccbced83e09abd6ff633e0397379c0b1829720ea7e7e7bfd413c629d989ce476641cd129b416061472ff56af93f9a457dbe1e8ccfa708cc092b4309e21418dae8031147d5562fc4e7d8a28f24c5ed4dcae175406ca6f1f5a0ffa0e9085716a2a31779ffc09b446bd2d8a3a9bff396adf06470894da14e580af7b5af9a293dc555e53e12112706dfa8ce53e7b4986bf71ae609f207987e47626532a", 0xb3, 0x516e}], 0x1, &(0x7f0000000480)={[{@bh='bh'}, {@data_writeback='data=writeback'}, {@journal_path={'journal_path', 0x3d, './file0'}}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x100000001}}, {@grpquota='grpquota'}, {@delalloc='delalloc'}, {@discard='discard'}, {@errors_continue='errors=continue'}], [{@func={'func', 0x3d, 'PATH_CHECK'}}, {@subj_user={'subj_user', 0x3d, '/dev/hwrng\x00'}}, {@context={'context', 0x3d, 'user_u'}}]}) ioctl$BTRFS_IOC_QUOTA_RESCAN(0xffffffffffffffff, 0x4040942c, &(0x7f0000000540)={0x0, 0x1, [0x4, 0x8, 0x4eee0b22, 0x1, 0x7, 0x4]}) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:27 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1354.722062][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:14:27 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:27 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000240302000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1354.776464][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 11:14:27 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:27 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1354.834706][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 11:14:27 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1354.904902][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1354.943095][T25844] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [ 1354.961508][T25849] EXT4-fs (loop5): bad geometry: block count 515 exceeds size of device (512 blocks) [ 1354.987355][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1355.028743][T25789] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:28 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000660302000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:28 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:28 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x24c, 0x0, 0x0, 0x0) 11:14:28 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x150, 0x0, r2, [{{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x150) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:28 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40305829, &(0x7f0000000040)=0x6) close(r0) ioctl$BLKROGET(r0, 0x125e, &(0x7f0000000000)) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r1}}, 0x0) io_uring_enter(r2, 0x450c, 0x36, 0x0, 0x0, 0x0) 11:14:28 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1355.543118][T25890] EXT4-fs (loop5): bad geometry: block count 515 exceeds size of device (512 blocks) [ 1355.565397][T25896] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:28 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000c10302000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:28 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x3, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:28 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x24d, 0x0, 0x0, 0x0) 11:14:28 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x720b, &(0x7f0000000080)={0x0, 0xfffffffe, 0x0, 0x1}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = geteuid() setresuid(r4, 0x0, 0xee00) r5 = socket$netlink(0x10, 0x3, 0x4) r6 = geteuid() setresuid(r6, 0x0, 0xee00) syz_mount_image$udf(&(0x7f0000000680)='udf\x00', &(0x7f00000006c0)='./file0\x00', 0x3, 0x1, &(0x7f00000008c0)=[{&(0x7f0000000800)="39e6b99b71409c0bbd4b00ef488e60cd950e3f729327f4d0c713a6b9659eb689516a0f4df8bfabc3112fb3568027665159b645e17ba8fdea203e9c067d92a1aee79483abc237e2d6fcb01ea59a4668a2ff968497d7825a98cdee0b1ee268bbace2f609366737f1e144aebb7fb61ef7ee0b7ea73ee937ecf62564bbed6ed6469ad0087cbfcd38549481a0a171", 0x8c, 0x6}], 0x0, &(0x7f0000000900)={[{@rootdir={'rootdir', 0x3d, 0x824}}, {@utf8='utf8'}, {@bs={'bs', 0x3d, 0x100000000}}, {@gid_ignore='gid=ignore'}, {@umask={'umask', 0x3d, 0x8}}, {@utf8='utf8'}], [{@euid_lt={'euid<', r6}}, {@audit='audit'}, {@fowner_lt={'fowner<', r4}}, {@smackfsdef={'smackfsdef', 0x3d, '\x03{[.&:-&{-'}}, {@dont_appraise='dont_appraise'}]}) ioctl$sock_SIOCGPGRP(r5, 0x8904, &(0x7f0000000180)=0x0) capget(&(0x7f0000000380)={0x19980330, r7}, &(0x7f00000003c0)={0x1, 0x982, 0x5fb, 0x0, 0x3ff, 0x4}) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001400000000000000000000002c00020073797a3200000080"], 0x1c}}, 0x0) syz_mount_image$befs(&(0x7f0000000000)='befs\x00', &(0x7f0000000100)='./file0\x00', 0x179, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000240)="813ce1588620fdcdaba4212cf4a4261f202fc1e6c34a760ba9088e5761b15c56e23c4a8967c2479c4f01f96f5e85d2fdaa69a6e10547f3ed58d4d7459f9e6a6bf1a7a3e9134ad2495f753fcd550d6afa41b666b25328b22a4f739813bfe2297edf9d8a1d8c07f6cb383cd589b6af5ee87b37b1c847d4ba71f47e4213a0bc4f1c8854426668cb6cce2fa18d0a26704583e27009184e1a3fabbb8c2673ccddac390a41bc554c8242ae226d423789bfa2b94e50cea8", 0xb4, 0x9}, {&(0x7f0000000700)="73c91fca283b8e86136bab035af0aeb832e741a0878e0c8455db9527c7035eb7bd1d1033eaed6c5fb1960d561f836390ed25b6c1c952089f6ad9545f856183fe06aa234b06d82d30b201debab1b949cde775f211ffea6126172486082f4c4f36c43b04bc799ea0c5f54ed25eb5b36c913b36741648fc8224fb6fe0c9ee73e953cbd29fee8eba29b669c3003d4b3e612c8a95eed6534f956df9c31fda59e6106e246ea86499fd922b46837fbba35b09bce02dd4c9e4f9cbb80a0073efc6a6c354c3f3f76eb5e753c2f1b1ce6b614db596da9c96c3f842ba8d9498dba61748e0e5bef58753c00d57", 0xe7, 0x81}, {&(0x7f0000000400)="284a760a7787bb725692786ca0df6c03ffa3450895b4039a8d46724d3ce2d8a8858be3a187662f317eb3238c6734c0f2dbcd1aeb12a2d1f37b87ddde9d8584c3a7ede443235d5140ae208a3856892d89e779075f241a4f553316696c27023995edf3f194a4c7c5100e38b17bd30c9d2fd32a07f26cb5d85b72e711895bffd4fdd7487c425ac549c45a5ead73bfe76e0b0d81bf63aa9f6e4b18460bfa7912b31b996a", 0xa2, 0x84f7}, {&(0x7f00000004c0)="c873b7d5b7e7a3589031edf319c1ec85fe083c63c995c885c9bf78ee90fa8b64abea611e928a2aab2044551fcc480f3ec8a033b248c5f5191e8e35c738a4bcc43525fa35790701b5a0e6a4a0df6a25058d88ad3bcc5f8295", 0x58, 0x8}, {&(0x7f0000000180), 0x0, 0x2}, {&(0x7f0000000540)="f4e91512d8ff5d8843a4ddb5f6b9af012d84cd66cbe26101e442ba24ec4842daff29dba8959a4a20f1bb08c1ca184b129dce83abea4196c7899a2aabf890859a1e4e6419a68c3162385bc4cc6413a71bc0ad75e8f8d0c3f4d59d7beaad5f0cbe1ad0324dd87cb93b0b6c81c4cf1715ca8f8078", 0x73}], 0x59826, &(0x7f0000000300)=ANY=[@ANYBLOB="252a2c3a3a2c2e2c7b26235c5c21262cb45d282b3a262c2c5b2c7d2c657569643c", @ANYRESDEC=r4, @ANYRESHEX=r5, @ANYRESDEC=r2, @ANYBLOB='\x00\x00']) [ 1355.679808][T25914] EXT4-fs (loop5): bad geometry: block count 515 exceeds size of device (512 blocks) 11:14:28 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000020402000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1355.846563][T25930] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1355.859572][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1355.873637][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1355.901049][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1355.913531][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1355.926454][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1355.939102][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1355.953057][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1355.954704][T25937] EXT4-fs (loop5): bad geometry: block count 516 exceeds size of device (512 blocks) [ 1355.967889][T25941] UDF-fs: bad mount option "rootdir=00000000000000002084" or missing value [ 1355.986038][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1356.001845][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1356.014290][T25930] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1356.228388][T25941] UDF-fs: bad mount option "rootdir=00000000000000002084" or missing value 11:14:30 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:30 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x24e, 0x0, 0x0, 0x0) 11:14:30 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000060402000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:30 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) recvfrom$llc(0xffffffffffffffff, &(0x7f0000000240)=""/4096, 0x1000, 0x40000000, &(0x7f0000000000)={0x1a, 0x7, 0x3, 0xc1, 0x40, 0x7, @dev={[], 0x28}}, 0x10) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:30 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x56e2, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1357.999124][T25973] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1358.022304][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1358.041172][T25972] EXT4-fs (loop5): bad geometry: block count 516 exceeds size of device (512 blocks) [ 1358.112263][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1358.138167][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:14:31 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000100402000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1358.222414][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1358.255593][T25996] EXT4-fs (loop5): bad geometry: block count 516 exceeds size of device (512 blocks) [ 1358.277645][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1358.301313][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1358.332980][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1358.350883][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1358.368625][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1358.385574][T25973] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:31 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:31 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x24f, 0x0, 0x0, 0x0) 11:14:31 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0x400086) close(r1) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f0000000000)=""/157) io_uring_enter(0xffffffffffffffff, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:31 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000502000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1358.604745][T26011] EXT4-fs (loop5): bad geometry: block count 517 exceeds size of device (512 blocks) 11:14:31 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000602000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:31 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1358.752962][T26024] EXT4-fs (loop5): bad geometry: block count 518 exceeds size of device (512 blocks) [ 1358.914824][T26030] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1358.934092][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1358.946467][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1358.969214][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1358.987080][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1359.015963][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1359.050723][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1359.068682][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1359.087009][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1359.103917][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1359.121580][T26030] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:33 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:33 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000020602000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:33 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x84a83, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x1c, 0x0, 0x800, 0x70bd27, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}}, 0x4008000) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:33 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x250, 0x0, 0x0, 0x0) 11:14:33 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x0, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1361.069418][T26050] EXT4-fs (loop5): bad geometry: block count 518 exceeds size of device (512 blocks) [ 1361.093294][T26055] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1361.124107][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1361.149057][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1361.167442][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:14:34 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000040602000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1361.261590][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1361.303621][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1361.330960][T26076] EXT4-fs (loop5): bad geometry: block count 518 exceeds size of device (512 blocks) [ 1361.356650][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1361.411408][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1361.444894][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1361.487484][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1361.503966][T26055] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:34 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:34 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x251, 0x0, 0x0, 0x0) 11:14:34 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x307882, 0x0) r2 = syz_io_uring_setup(0x7b8a, &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, r1}, &(0x7f00006d5000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000f00)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x442040, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000000100)={0x0, 0x2}, &(0x7f0000000180)=0x8) r6 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000680)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93cb0725be6027d152f5e8e198a29e5c0d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308", 0xc0, 0xfffffffffffffffe) r7 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r6, r6, r7}, &(0x7f0000000440)=""/243, 0xf3, &(0x7f0000000180)={&(0x7f00000001c0)={'crc32c-generic\x00'}, &(0x7f0000000040)="68d6e1c6", 0x6}) keyctl$set_timeout(0xf, r7, 0xffffffffffffffeb) sendmmsg$sock(r5, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000240)="828834fe15a63b5bb564911126e65f5ac611316b227df1db50f1e2db3e815aa57177fd259fbda357408bf074d215810f3e21b8c1f0f396", 0x37}], 0x1, &(0x7f00000002c0)=[@mark={{0x14, 0x1, 0x24, 0xb72}}, @txtime={{0x18, 0x1, 0x3d, 0x5}}, @mark={{0x14, 0x1, 0x24, 0x3}}], 0x48}}, {{&(0x7f0000000340)=@ax25={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}, 0x80, &(0x7f00000007c0)=[{&(0x7f00000003c0)="a32ed3a2f510f5d451ca6b963065deab1468369ea343119e87c36c9bd3ab269e94cff22d2e85956d35c69f57ff87265925da667b6753e0edc59aafa4b3052507907456c209ba6e75af7bfac4b7759bdb940520d1e7613c1a977c0544497467c50eca32c149fa2e822801f7bd8d0bb7736ad3f6df9062a8454904a8e60d22fe4b", 0x80}, {&(0x7f0000000440)="343c7c0c6f6751129e4eef58184f146c7ec280ea08a88bdf16389f1c6b20c8bee95be8b20cb7937b25d7c96dd2a056b46ad20826aa64f1e262eebfc27499489c4e6eafdf4834ad94bb67aa6b7518be3b93ded4cb158f867d326ceb8c5c1c5eed2010fa44d0ef62ede99a44ac539cb4b0380715ceab27253773bd1cd6e1ff19637df42c3a39667d5703f9c39cecb79d7374d2309f1adf0b119274358d93cd94fa603d3a8f997d1ec3cc289a2100f6d68cf9277ac4020436096726e30fc825", 0xbe}, {&(0x7f0000000500)="0583ef73c14268c62a5ae7286b61b9ed6eedda9c294c6261f661e71de010c396b69ac59840ec7650c607aa288350103d9c1cfb30a94a6d16c2304ab8bffae9aedd9c3963d0878109761472fa2f08283c36559a7f1770a78ad20d4dc21eeb7ce59057e324b80407b33f7b80c262726444cbfdb0fc809bbbbd57aa34f5ebf62c0ee0b2ab222ddb63c0d619b38312149ddabf22758b4f162955d46db474cbdcfc1298e9983d682604070ca36d15911a73945c6bafa9620088d348f50abe8408d62e29e266bf8d0363b8cd628d4edf25b920204c6dc629da506c850802bea5798e660bd4f2d3a30d9c1017e3f342e4b7d63e8f2a253a124b114c16e544", 0xfb}, {&(0x7f0000000600)="df2b28769bb39287b4602bd18614f23b1253093a37b96e51e1dd2e64db8b563f04aefd64c12b6695e292c6d50dfc8517ae66d9c8394d5bac874a", 0x3a}, {&(0x7f0000000640)="3ff7767d3fc3328a30f749a26d9ee9896f9326765102bd8afefe802c350e9b1c036e86ca31f6a5cb49fa11345eff6de9e2c83fbc6346cd717ba0be495028a7408f8d9533ad3efa80d8fd775848c80f1d9fc8e2d5bc7089f8f527d5c271e2d56556abd149d957cc91dddc61b478452c850489375bbe9282f140c8473c3da6290f8dde4f04cf7d0e78673cde265f9db6c8ab153872a837508dcab16f65527890d726967c7328", 0xa5}, {&(0x7f0000000700)="a173be95b716f07d1a7ce00d6c3ad6e9825a204008fca43f0fa0d2d8e739d4fb149c0035ab90c338e1912772e640f622c2d9c9fb717c01b3862d56b8078043749d36c555daa0cb519228c9b3d7df9d7fa137772857c75368db908078eca06861b76b1e79b0e41ded9b16846fa5ba87348e6700b0c950aeb2af260b217bd4f2304c416646568ff6c488642873391fd141f4955c72", 0x94}], 0x6, &(0x7f0000000840)=[@txtime={{0x18, 0x1, 0x3d, 0x401}}, @txtime={{0x18, 0x1, 0x3d, 0x57f}}], 0x30}}, {{&(0x7f0000000880)=@ll={0x11, 0x6, 0x0, 0x1, 0x4, 0x6, @local}, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000900)="df388655cf945ed30d802ef14ba94d83eb868693eea4f0051cec1575a6aa45cffb7cb827eb72004294d0cd2d0bf802f79c7e09d1abb3a24147535be273baa514303b6c2c13ea3b3357334a458be4b79d136924cb6549f779f2a555d31451a85e284cac6abad02a14663453e97d5e1525d47ea09b81bce967569cc9a6b6afc63d82c8d4094f92abe676d953ed099d788631dae3a289f60cb730bfabd17022aed3883f3aba964d9267", 0xa8}, {&(0x7f00000009c0)="c6a374027c6a909529fb64d5f5af981b553ac7161b60", 0x16}, {&(0x7f0000000a00)="c2a5ea385f2ab60cab9e9d234375bb6a811ac869d6719ee0fda88978ee3900cee210e1a1f2af3a365ac05fef620bfcfd12c73a5ddd9602556a2273c5d82c0402825c030f039370e3a8eb49a9deedd4a3583e1b29050425f93a45ba81e2ebf46f75b7e4ac6863b987f147688e202323f9b7780734f0d2ca4d06096f5a40648d2771749677fdb8dd53d89a9068861210d182bfbb840daeffdc2268466c155996aad0ef80533784284714dc99e59bcf75bbf898202ee4e343cb50ba3d3b857134684796f55b108dec5671671f2b90fb59ab30e60f1f0f46d9", 0xd7}, {&(0x7f0000000b00)="5c0e3e48cb61bc06d619236b959453cb42efdc85e47aca37206b4ef8dc12db40743828fb53ce0a8c8b48dbef8f3d171490118cdcdd4e5df0fba240df6e2aaae163f3fee4400cfdaae47c40b50e1d813420b1cfb68d69a973915a8d92189ceec5dfd8a04629ea99284baa02971d37e4d122238f28dbb7b2a867248bd786", 0x7d}, {&(0x7f0000000b80)="528fff6de4982bbd668e6324d566eed0a22daca2d17f3a6842b91f66701f39595f789e77f6f2bd9616da04ba0cf6772974fe75ba7855040a26272a5662ca1c55436fa10d67df66e192c8043b9f4b8570ec31f39cec844fc0f49d3f4dfacff159ac946153f6612df8dab4ffb1114fc452b2d9b98f43e01ce9d83daf6b706011177c4f67fc276c956c1a66535a8b64cc461a6f78621331aab47fc9bf793ea9e6fb296b3c88ef9f4bf44b86a0a2e25971f06548b6c896d58bf3f3e1e5a49646edde5113da60e62de109d7717c93cc78c8226894cee186ca020961153beb877f3f3008a9f10a7123b73cdb50", 0xea}, {&(0x7f0000000c80)="bb11f1424a68356f244e6f1dfa431eec58fefaed83ff2aff9d5c9ce1c74f41e4313fcd0e9504bbd866b3f3263dff0105d30e77489167ad71b4901b0a34695a9dcadf9948c1839a7509b9f8f4f37006107618eaef4c2a7abdfa", 0x59}, {&(0x7f0000000d00)="29bb9b3a0ab565fe215d75b0c01d810b98cc2935da9040f2ce1c", 0x1a}, {&(0x7f0000000d40)="3c336c5d00f9d4eb165ae8ccb8844caed9342dca87caff175834adf23e46b6b455b260d6f58cbf48faa17f036278cdaa2b51f027145236aecd12b330c90e0de3202a07b74ee7c052867fe1c43ab244e8376c23306ae36d3314ae2ceab9eb31dd6c80", 0x62}, {&(0x7f0000000dc0)="d1fb08ae0d09e10e330c1714f029e6b7557b5bf62431a6dd994243d0d9238580d080da4a8220e52ed6853b5bd7a729493eb734fb85296a45bc037ab0dab7f9ead25c046c8f0c7960dd785d8d573f21a6be6c8e13a3c00c7945c7d511986f66f20e1f86072f291847f4161a272175", 0x6e}], 0x9, &(0x7f0000000f00)}}, {{&(0x7f0000000f40)=@vsock, 0x80, &(0x7f0000000fc0), 0x0, &(0x7f0000001000)=[@mark={{0x14, 0x1, 0x24, 0x6}}, @txtime={{0x18, 0x1, 0x3d, 0x8}}], 0x30}}, {{&(0x7f0000001040)=@nl=@proc={0x10, 0x0, 0x25dfdbff, 0x10000}, 0x80, &(0x7f0000001500)=[{&(0x7f00000010c0)="0f6fbca29023aa336e9f71ee6845cb7eed8cc371180e4576d28744af770a45f00f318593c07741cc3222adb69cbbbf7bda8b2c5756dc9d3e102010ca58338cbe19f463b49dbc1fb944a7ccb6935da415c8470448b6b1ac33144218311371e0122122e17b333285c687e679fdcb4ec744befe6fde320c1f2a5c70dd36a0a2832e567c4043", 0x84}, {&(0x7f0000001180)="1194aa09f0cbedf74fa3e2febf7a66d674ed5c6e1e75d02fa75e48cb2c98282561cedf33dc918e6da4bc9c9e811849e2bea2e6da470a596664c9bbb5733734b07b388eee000fcade73adab517a8e5eb710d81b23b818cd570272d83c213d087cd209da1e78d1d47d4fffe51578e53cee35bf0ea975a38d0b85e07ce7e5737b37039df9b967a8c2d0a3c10f70c1759f9bf3c4d64ce3a2f861d6b357e6613bf8a78d38", 0xa2}, {&(0x7f0000001240)="b8300239e37f38950ad96231195d9c6ab14dc3daa4952767620c429c606e96c08a76b49757e61e988e2efd1188618fd818cf911072c940d834cd0c95ffccc765dfeda60ddca8ede1938b6633b9c52d30b12100281ab38a2f272dae9e2dbfe8abe0ccf374566bce77f2875b56415db817d4eb17ff06f1cabf1201e5b739280eb206ac3d52d7c82b395facd6524b88ca64bafd0fbca82a6e9989c757ec9fb11ae75f1e4a904a811031cf2d58e22215283143dfa401f82e7bd155", 0xb9}, {&(0x7f0000001300)="f507f2a8f373a5fe2cbb16f355398ea53c4f9622f281af3548eab8727c52cbfbaf1feb21d231e54ba7873b5473861ff710173f803db95a3f0ab41e90487dcec50b0bcb63fdc91ad76e7ad9ddeccab719764003a7c8e935a4306f0d7689531470b08e62ced95467ef80a6d763d05814379aefb0a59c07fac4061389aebc39616cb0fa50f71ee44e7f9d363a58e77943de1c437b3e7024ddb53f623cad58d5589955667bc9eb719cdbb3470be00bc56bbfbf3d8a41df6c8b0d69b9206c341141a0fd0e134c747801e0460b3a8171be34f9fa51592224e7be5e", 0xd8}, {&(0x7f0000001400)="5f6be5725d38c58596b28142cdba1809a0a6a8f1b45d7de7ba89e24da00c8bc4cb7a723eec8c2c06f31e3b2f47e4f7edf6382b4cce3464256779221b0346f8e7af1c7b9a", 0x44}, {&(0x7f0000001480)="2c28b160266bd1e66bd1bb5f106de18a66f67b3995ae065dfa728824025786ff174e4b1c2c08ea5c2eacee008ea6e02ec3e33154cc8dafab9b16e6699dc1f395b9d47c4538358a46e7f3b27889d37e5904065be5da486c688b4adf075bb231535758676cabbbd477d5ff4d572c2642", 0x6f}], 0x6, &(0x7f0000001580)=[@txtime={{0x18, 0x1, 0x3d, 0x80000001}}, @mark={{0x14, 0x1, 0x24, 0x6}}, @timestamping={{0x14, 0x1, 0x25, 0x5}}, @timestamping={{0x14, 0x1, 0x25, 0x10000}}, @txtime={{0x18, 0x1, 0x3d, 0x3}}, @timestamping={{0x14, 0x1, 0x25, 0x8000}}, @timestamping={{0x14, 0x1, 0x25, 0x2}}, @mark={{0x14, 0x1, 0x24, 0x4b438ee1}}, @txtime={{0x18, 0x1, 0x3d, 0x100000001}}], 0xd8}}], 0x5, 0x100) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r5, 0x8982, &(0x7f0000000080)={0x1, 'bridge_slave_1\x00', {}, 0x7ff}) 11:14:34 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000702000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1361.645507][T26094] EXT4-fs (loop5): bad geometry: block count 519 exceeds size of device (512 blocks) 11:14:34 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000902000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:34 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0x4}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1361.860659][T26116] EXT4-fs (loop5): bad geometry: block count 521 exceeds size of device (512 blocks) 11:14:36 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000a02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:36 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x0, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:36 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x252, 0x0, 0x0, 0x0) 11:14:36 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) lseek(r4, 0x7ff, 0x0) 11:14:36 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1364.107127][T26144] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1364.110855][T26146] EXT4-fs (loop5): bad geometry: block count 522 exceeds size of device (512 blocks) [ 1364.120688][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1364.141650][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1364.154315][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1364.171425][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1364.186154][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1364.201145][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1364.214528][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1364.226990][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1364.239431][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1364.252194][T26144] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:37 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000b02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1364.443961][T26161] EXT4-fs (loop5): bad geometry: block count 523 exceeds size of device (512 blocks) 11:14:37 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:37 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000c02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:37 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) membarrier(0x1, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:37 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x253, 0x0, 0x0, 0x0) [ 1364.758576][T26182] EXT4-fs (loop5): bad geometry: block count 524 exceeds size of device (512 blocks) 11:14:37 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000d02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:37 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x0, 0x7, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:37 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x4, 0x100) sendmsg$RDMA_NLDEV_CMD_GET(r4, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="280000000114007001d668eef3adb4259ca4080001000000000008000100020000000800010001000000897fc57dbfdd39f4e268cf4151b2546fa1c6bf4f181ee1e67d39a12aae2a707b24367c40789f2451b48696ce8cea77cd01f883b56ceef4ec3031d8fd952987541e631c196bf137e2"], 0x28}, 0x1, 0x0, 0x0, 0x80c}, 0x804) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1364.992296][T26200] EXT4-fs (loop5): bad geometry: block count 525 exceeds size of device (512 blocks) [ 1365.064905][T26207] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1365.108674][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1365.174046][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1365.203432][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1365.226290][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1365.243418][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1365.260870][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1365.281011][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1365.299130][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1365.326830][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1365.344860][T26207] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:40 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:40 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000e02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:40 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x254, 0x0, 0x0, 0x0) 11:14:40 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:40 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1367.136150][T26233] EXT4-fs (loop5): bad geometry: block count 526 exceeds size of device (512 blocks) [ 1367.151320][T26231] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:40 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:40 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000f02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:40 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000ee6000/0x3000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:40 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x2, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:40 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x255, 0x0, 0x0, 0x0) [ 1367.742199][T26272] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1367.765279][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1367.789651][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1367.798841][T26281] EXT4-fs (loop5): bad geometry: block count 527 exceeds size of device (512 blocks) 11:14:40 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x6444, 0x3c, 0x0, 0x0, 0x0) [ 1367.844453][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1367.892317][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:14:40 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000041002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1367.938070][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1367.993178][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1368.021252][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1368.044552][T26309] EXT4-fs (loop5): bad geometry: block count 528 exceeds size of device (512 blocks) [ 1368.116973][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1368.159925][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1368.193625][T26272] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:43 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:43 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x256, 0x0, 0x0, 0x0) 11:14:43 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000201002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:43 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x40400, 0x0) ioctl$TIOCSBRK(r4, 0x5427) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:43 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1370.232157][T26333] EXT4-fs (loop5): bad geometry: block count 528 exceeds size of device (512 blocks) [ 1370.244293][T26335] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1370.264984][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1370.353638][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1370.394151][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1370.423342][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1370.489724][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1370.537167][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1370.566354][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1370.578831][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1370.593158][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1370.608186][T26335] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:43 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:43 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000001102000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:43 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x257, 0x0, 0x0, 0x0) 11:14:43 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x3}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000180)={r1, 0x8}, 0x8) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:43 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1370.848522][T26365] EXT4-fs (loop5): bad geometry: block count 529 exceeds size of device (512 blocks) 11:14:43 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:43 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x258, 0x0, 0x0, 0x0) [ 1371.074347][T26394] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1371.102548][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1371.146441][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1371.170512][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1371.205886][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1371.233843][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1371.268201][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1371.307998][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1371.326112][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1371.344223][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1371.362268][T26394] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:46 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:46 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000001202000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:46 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x259, 0x0, 0x0, 0x0) 11:14:46 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x0, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:46 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2004}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x41a5, &(0x7f0000000080)={0x0, 0x4695}, &(0x7f00006d1000/0x4000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) close(0xffffffffffffffff) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FBIOPAN_DISPLAY(r9, 0x4606, 0x0) r10 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dri/renderD128\x00', 0x34000, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r8, 0xc0086420, &(0x7f0000000280)={0x0}) ioctl$DRM_IOCTL_LOCK(r10, 0x4008642a, &(0x7f0000000300)={r11, 0x21}) ioctl$DRM_IOCTL_SWITCH_CTX(0xffffffffffffffff, 0x40086424, &(0x7f0000000240)={r11, 0x3}) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000180)={r7}, 0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000100)={r7, 0x20, &(0x7f0000000000)=[@in={0x2, 0x4e22, @local}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x43}}]}, &(0x7f0000000180)=0x10) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1373.210797][T26428] EXT4-fs (loop5): bad geometry: block count 530 exceeds size of device (512 blocks) [ 1373.243264][T26429] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:46 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000001302000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1373.278335][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1373.319591][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1373.392119][T26443] EXT4-fs (loop5): bad geometry: block count 531 exceeds size of device (512 blocks) [ 1373.410341][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:14:46 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x25a, 0x0, 0x0, 0x0) 11:14:46 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000001402000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1373.526534][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1373.558427][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1373.604505][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1373.682738][T26459] EXT4-fs (loop5): bad geometry: block count 532 exceeds size of device (512 blocks) [ 1373.726255][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1373.787412][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 11:14:46 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000001b02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1373.827482][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 11:14:46 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:46 executing program 0: openat$urandom(0xffffffffffffff9c, &(0x7f00000015c0)='/dev/urandom\x00', 0x80400, 0x0) r0 = syz_mount_image$ufs(&(0x7f0000000000)='ufs\x00', &(0x7f0000000100)='./file0\x00', 0x31b8, 0x5, &(0x7f0000001380)=[{&(0x7f0000000240)="04b28507b93f4fa39f92a1644154f6613db1eb93eba1cadf7a0397cffc918ff0a9d1c9ea5caca7f9c17b5c348f70f5cc3017e311c68b0c40e5237ba80b15ef9b8ea2986ad98f0a5da4eaf44d6b0e2a8d9edb7dd1fd42ca167ea3777af93ed0f5292cc5b8063ed0086e25c58bee62b13714f72143c92291c394cf761478", 0x7d, 0x81}, {&(0x7f00000002c0)="342fd9371a2790f7847f2a42fb1e9be1c6d1214f2842747e1c2a058457b9f49351ca9ce56458e76e78009f8014c6435eeaadb746bf3429a1063de65bfac3d0c50f1fefb408e18d813416298c1e1ebdf3e11221595971b0d68194b0122cf8ebfae79e4f9df1fc8f49bcb4e7e7453e717633cb91e6acad2fe1e9dd17095b286518c3bc08544ec44d802c4095246f0bc83ed24a191a910a0ebdb8a92d6b2b21fe30058ea8b8403e3bd3b69d7314407a477129e374d7ad3ec17ed88dd1991b649f9bf0a68d4a03baa7caea7bd445f9c96250e6d00f31d72038742c302f04643a43408c17ddfd904dd5a29c3c9ab69c2f89386c74d7fe044a1791582e25aae3988b6beed8ab4ca51ac53cb55fb5a88b37b277df6d1581ea22192859be437f0b14a3d5e81bcdcb5fa29ff9ac6f3f8059468e953a7ea9040deab4d237629f1de10613addee1a72a40531af6d7b1aac4bcbde9b703792008037f48b218d039ac7fffa3fb69df2d12b550f27fab104758fe22eacc6644fc14c6924994b9447c1074ce1c06636e882057ad807ae946ed26e845fd88a90970071cf2c243b07cc0e4ae5ac2f94ae9f99a8f3db36ee6a9b7c8cea75dbdd6c839b2f29302ca96e286595fd2d61672a6e46126a0ec29122bfe55bcab6833717fa8819234700a47ee2d5a4cb309b2f48563b09519752ed66ae11a974fdb0d20061a74cc8dde6493460e63a1f9dc31312def343293bb0d5d894508bba92398acd3fc26f4b12fb4d744024d1364c7bcd4845709ce563043b6f799c15108576eec66be454559e170eed69b053960845f9da8a46f8ffc4c65094c5ac161aa29a47072b01d3fb9730ca75be907c743951de6dcb13b2f9376cd31421235ca1be069cd8a2f555529ce0fa9b1949f11f2b63c970229616dad00c19559c590d7b72d07b31ab54755804e87b7cfa2e7eab80b0da798bd79e9aa73f659da09df026c4da40c6b42520c4013340297bbe4c1baa1455b25662aae81ddbf7f7ecacc98d04809e1038c910f5682d5062a355a7d22c32bf079d4f646e0b49d4add139d6515f1dbfd0da0f4bba4d72dd803d60d3b9680e09cc8bf5ab307619501065a4edee86a0514a6059c72f312939a2e22616d5b45143e391dffe09c7b192fab89fb1775b5ad8de3b52f2a07cb5c73e5fbfefb9449e385c9644f921afb7ead898d3835c298f0d375a6a8baa78da5942ef63e59ed16187d1bbe563804f5296b5c04743e79ba758bfc5d9c5d48bcd08b75c21d496ef0c8849b558ff8f4227b7ee931eee5a088f0ba4006374b217f38243577a697ea640be95a44f69a7076263962945fa5d3700e86c8a1c0f9315c8bc7928788dea668b684397ef7a3febfbf444af0ba06ac860889583a2cbdf8169703fb8f3e9bb5d7ac786923e43e90d06b1cf3501da07baa6d346181f1e8082365190bc1c2f8270f3bc4f6a830326e12bed68fcca5b4995357a9d57ab1eeb5d1f7778860b921b4fedcabf9072b3c5f1d25bf9984df0cd58fb694e6bbb03450a6c3085d06d6af2028a933f1944b489f36a1c755ff934ed6a169e99f3e30dd717f8fc5bbed2e3111f3ca1dc2aad93c75b4ea2fda37b2e87d85c2eb7941b30867b9cc6e6ea917d905368efae2062cf28d8c72c825361325a0dcdd2f43e09be8da65115119ef6a4e6aff26995eb09633988689847ef6d851c18fd47e9a7884b00e7c1d8123695ba23bf157ea3703d0546fff8dced9c852a3be103641b48fd321710e6970d9e902acbce81d0ab3b9a7dabeb9abf0c88b66f6c8bd8ac62db179648d18883abedb3ad6ab885205f2da6b9b5bff7d4023eac42f46cc1ba70749b47046a2145692738e5f56dfae7c10ff2933cb7451764255f88a6abee0e0388a1781be35234ff4f30102d001802f68dc0191e9edf1a11bfb6beba0fc25b7d3e54fef20cd0ea49d623b29ceb73e31a8faf1383e0680952009cb179c160870235f1dcd4f094f19523ba50e2d91c3fb0979224f8480e878f76ac18d8eb3c372b0113133bdea0058c32331a86f8462a7939373b6e359129bde52242de75bd39b40076a3dc03e1bb77bbd4fc567d90cf03df0b089a538e87a8597a8d45cb17c5448d3601911408a0290f711c1948795d1964388c844ec8c53a1c8cfa235ada35e11ea05c959f6dee0676f23505ad4a6e50a244ce9dbb351eace1d810d47b90e1aa6b3d39df7e7c610c7abc96b97fc515525ffecb33005e75e464c7a3ae55e6807b73cbd214a62784c0580f0ad62163749041cc8a752295117a011937dad3d36e1b159c50ab54e07fc63def393fbdbc11c600318be02dfa49e714216d47c256113ac5ae8a60a367e09f6d92b801679c101784e9b7cea74c9e99d32487a9de425aab7baad72f54889467fce19e1b538e6b406fb5ad1695fb155575772074ad86d01e5c370e435721ecd880d833620b27995461a44e0f2ab6ef5ef2da5cd4a29c48631f0f9184272a656249d70ae0bebab5e5a74c5eda68408af38a41db29e72b6d9b1322b632d563ea6420c1639a25b46010ea71e9e50e27b5dd63fc0e4e02f52405e8fd45a65f93475542abfbdfe9ea4461e7707439c85b5a0d8194f877bcd3e05e4f8215ec19a75c04848f9362302691cc15e167bdbf55341d86b76b86aeddc65fa7d8055bfdb640ff3dae73f05ff4328bb1cf5210a328e2be6270d395f1682c86615745e6116353612ffa16db32ba27113d58eb31b5bacc05eee64953ff659f98b8fd05ab10ec4bddd9f34187c1d148e87b84b9660e6e9a541eabab9dedaf0ba9a56eb7b9e78034eb7938141be880a16fbd7fcaeeab6083ed753251f4c28229cf463e793e942c5c030943bd25f0e25ce0054407d982beb9ec0e52aff62ce5d5b708ba883d7a6dcccd3694d8c36001a496c24e80fbc3ff11df86739fe9475f6870978e5dedd6b9af61a260528bded1f8f310e187a934d73ba0cfdff1c6e7bf3ec197e91198326874698eadae40e119fd4486dc1654a4eee178817eb2ee3c6617a07c7277072bad6bab0fbbcd18c11d2e78946665c0911c6332d74e82ff8141aeadb8fb9ed08d14256d7b093a536b16ba8c752c9a56348757b828c3a86cb1c3359add0f7d81694a8b2404e9cc6ac76405d1654372384022664cf711de156b3fec5e84cc200e568e34c83357db5959ff751beb214ed5a42177591ce67fe661f9cb671e37e07e569bffe1802d43b980e2a9aea90dfd207b22b63f2790fd9b684b9dc88adc636c622716a6ddac7df3849836457cb5c12e289fb342345719764a401000ddc091d82db0c7a2a7c9d5ab00e0b3ca14d59d7894b618a24bff45051827451802b265aec3aa397577dac0a081ad94d61df6c379d8bd6c0ebb59c7857c5ea500674d0eebc89f531249f518e892ac86f2225667753ed17adfa71e09d00df5230765da1cb553d861b5ded32e7ce9d5a3862e3d35572be711a6f27370f7374b650a1e8b18a3fd909bec47cc35d893539f4b8c44cd3ce69d5801eb70707b388db3bdb97aaf7fee812193fb7b023e199dbbae2dd6dcd327394ca74916fddcb18685d66321176048f782a74323b1b290991af8c00979a6291291eed7d981331f208b52abbea91e1cc70080226918cf7ca134095d444271cafc7b3552793a5ba29031ebb4346fa8ae6d8b3c7a4872f206ebbfcd7098af4d38a1ae4cd4f9bea82d3aa00a088e0431a4e0c921f6092535e775174a5c0a9bf85d8d9647d817d0ed966764ad9096344dd7a58aa293841d378710e5675ef838d2dada6ed985d9ee60480b1d2e8070343e3eee431d4ff999e8a206e833f8fd83519c9f893195c09a062c18a74b7f3fd577cfa0509044a0b46201249ffbd624efbd92df192d6b0aba724eab040bce035be8da524867bdb8994198670658241f3b308c51b3f8e27e6a937fb84b74a9bca769e75ca6b7a0736a58e37c02faf30d774be790bfbb6afb907385c633f8083d8ae2e0a446a6d8944458971501e0a61de6f9407303f792008e83ff690fb8d58d5299000fc4be9d3dc2845b17ac1d1d030a03da25c69812fa3ed4fbc252de05511705d938933e7a28b34f9ac6e9590805be8f646b1fe0b2e3a49d81753da226cf66fe2f743463e4461b5575ccacd16351b46ced9ae7bf09bcfa6787a721b327e0c05683a27d16936b84ff410bd521f41df8d8f447809f1c84feb20ff71efaf66e9c470bd614f11c56611bb3c0eeb54242a9be353bbf0bfa1c3630b0a6350738d500a85ce5e1531273e35d1ed5ad266225888aba4521ef85c7889736bb7e7c3240d49f18fe0792cc00fb4469234e69b1ef13d34108f3992b117a91a4587611860bb174ec738cf787a0c433c71511b04cc56a717048b62227491f8ce65ad2bb5b458dd57a62170f72a43e9821bb172d8fa25089d24ca71dc58b0a840ad0ee1f4e2463530b6ccd09bbd4bccf7e16cb12d78f0730186b276b07fb5bc26016298507b113cb4664fb4259cbb3114eb58e8af6694131ea9ab986dd2ea1bdf5b7a86115c30a62ca68c752077cbf01534764925bd73e090831ef52005213a229e105edb0085fadc9bd6976a841bae62727317af58256f9d4921ded08ed43f773187e8f4b86908153bfde52800753bd51a61d93ff71a7eb82bbcf773d00d42b682bf42da6a663b7690d6271e92fa03aae2eff6769b592712e923f9d536617275d007ebd998756e38391a93839df837bc644445c4675c944540590e7f2321312decb20dfb398ae34c3b8a073eab09aa7e3ecb2f6da96761a273e6af97ddd37ae406d2fc0ea370c37d678f447912fe3fe001ddbe11cc5604af3bb1837f54c583295a20ec3506261e7e46f11f00f5c53f2e77206cfa2eeaa543e5a6c9d52e85fa28a4e6e540849025131bf5946b4afa2fcc591d4b5642fd6d48880f0ea5c3651aac3a61579f362dd07419b60597ac391ae79033a1de36e87b408e9ae1c6a4cdf4c6b64c9584a5c70867e18f602331442c9c42ff9d1d10fe37e2c4b6ee80f8a7edb5473593584cfd83b8dffc252e2b1f015273d5de84baf7f67fef9ac8ef6e7d1b021bd19e5c6060c9e4733834bf3c481dae84bc5c10043358c1f329d935460104421fb4b8d31472e163a4558b35be58f21e88bf183053c236889f5a8263b7347c1636268e537af259f182ed1270a791190d19ed6d1affe1a5d30ca122f590bc18856863f61fcce4a5cce70b2afd8c9701f57b7624b98bae3e2209a9139392ed93a5dba2d621530c424c64559df318170715d916bfe0658c2e49dd8dd1ec1cf33bdddb3b112e9c772e231459aaccf0905dfc18ec8fd08faa2f57268f67854d68601c4a29841df0729de28f43c07e81d6e1df1f9efcfc18b9e6b1127afd320e4d238717c810fa4eb62bdd6f3ad7654be8bc222c915b51cb2d8d07d6d51d2b4f6642a063d1b0de09b4d4915687044c0b1ce08d763381f682d0fe13055209c3947cc04e366cb014790d4893bfd852daaa82d61ea3f9f4b0ee932a0d1f9cc95b43010e75ddca9a82978f39c75fc679145dbadf5f052c9c2aada10442147cc349d21907ea1404c6068f6d19deeea025c0eec7787dcaad275d7c6129e526f58b4d1ebdc5eea889725d446ffa7aad10e7be9d3c6cd1700b0f7f89b4aeb63214ed7ac693fc0ee8d5246250290996d92106e4ea5cd43cba994ddd84a02669d598d9ff9174b9b71c052196f6ae29754845905d4a8d97d73cb724b30896b583885818ee037cfe86c504df808d3dcc01a7a6e5482d3e197da4631e53f7bcffb3ec7ddf9bcb6695f7838430917e9ca1a6bddc6dc965694ed2d404", 0x1000, 0x5}, {&(0x7f0000000180)="374da919ffe396da0bb726bd8a37dfa366763b07c019024ed38ac112b0ef0d4aad584b8198381d54365141ad", 0x2c, 0x100000000}, {&(0x7f00000012c0)="53824abc4f547a8d0f286127b6e79278bdfa30a389fd8a7786787b493cff91efc78ba67015cb39e82f0c08c7d56cc1f20a983282813ccf5ec4ce3bb22b49a611dc4daec1b9", 0x45, 0x7}, {&(0x7f0000001340)="749ef31953a2f7ff5e8a72e2a531a34585940ce0a015fb55ef2444f6fd1538fb1797a003e23ca0b1b81ac12a6d0e75ff", 0x30, 0x6}], 0x200001, &(0x7f00000016c0)=ANY=[@ANYBLOB="283290d8ebdb917367ea2c2c7375626a5f747970653d2b29272c2e2c6673ff6f8e746578ee3d73797361646d5f752c6d65617375726584082905dcf6343ba78261626a5f726f6c653d2d2d242c666f776e65723d", @ANYRESDEC=0xee00, @ANYBLOB=',audit,fsn,\x00']) r1 = fspick(r0, &(0x7f0000001480)='./file0\x00', 0x1) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001500)={0x0, 0x0}, &(0x7f0000001740)=0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000001600)={'batadv_slave_0\x00', 0x0}) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xb) setgroups(0x1, &(0x7f00000000c0)=[r9]) chown(&(0x7f00000014c0)='./file0\x00', r6, r9) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x4, 0x200c, @fd=r1, 0x4f, &(0x7f0000001440)=[{&(0x7f0000001400)="e5fab3ce330370abd72227ffda8e2ec647a275b61fc32b74c374", 0x1a}], 0x1, 0x1, 0x0, {0x1}}, 0x0) r10 = dup3(r3, r2, 0x0) close(0xffffffffffffffff) setsockopt$inet6_IPV6_DSTOPTS(0xffffffffffffffff, 0x29, 0x3b, &(0x7f0000001680)=ANY=[@ANYBLOB="220600000000000004011fc20400000f17071000000002023fff000700c20400e582df17eca5c49293e5000000c204000000010401c905020001000000000000"], 0x40) ioctl$SNDCTL_TMR_STOP(r10, 0x5403) setsockopt$packet_add_memb(r10, 0x107, 0x1, &(0x7f0000001640)={r7, 0x1, 0x6, @dev={[], 0xc}}, 0x10) io_uring_enter(r3, 0x450c, 0x3a, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r10, 0x3, r2, &(0x7f0000001580)={0x10}) [ 1373.888868][T26472] EXT4-fs (loop5): bad geometry: block count 539 exceeds size of device (512 blocks) [ 1373.904697][T26429] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:46 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000001c02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1374.020243][T26483] ufs: Invalid option: "(2ØëÛ‘sgê" or missing value [ 1374.027056][T26486] EXT4-fs (loop5): bad geometry: block count 540 exceeds size of device (512 blocks) [ 1374.072608][T26483] ufs: wrong mount options 11:14:49 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:49 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x25b, 0x0, 0x0, 0x0) 11:14:49 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000001e02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:49 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.stat\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="0f42", 0x2) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="0000000000000000000013000000600042"], 0x80}}, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x1000, 0x3, 0x0, 0x0, 0x0, 0x5, 0xfb], 0x0, 0xa6200}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_NMI(r6, 0xae9a) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000000), 0xc, 0x0}, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000380)) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:49 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x0, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1376.233680][T26511] EXT4-fs (loop5): bad geometry: block count 542 exceeds size of device (512 blocks) [ 1376.259342][T26514] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:49 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000001f02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1376.295257][T26517] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1376.328033][T26517] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1376.355845][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1376.377304][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1376.396723][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1376.411881][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1376.427743][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1376.442504][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1376.443110][T26537] EXT4-fs (loop5): bad geometry: block count 543 exceeds size of device (512 blocks) [ 1376.457001][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 11:14:49 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000002002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:49 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000102002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1376.546185][T26542] EXT4-fs (loop5): bad geometry: block count 544 exceeds size of device (512 blocks) [ 1376.613030][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1376.681343][T26551] EXT4-fs (loop5): bad geometry: block count 544 exceeds size of device (512 blocks) [ 1376.683370][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 11:14:49 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x25c, 0x0, 0x0, 0x0) [ 1376.766131][T26514] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:49 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:49 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000002202000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:49 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) write$UHID_CREATE2(r4, &(0x7f0000000240)={0xb, {'syz1\x00', 'syz0\x00', 'syz0\x00', 0x53, 0x7ff, 0x1000, 0x2a, 0x8a72, 0x2, "c8295b8994a71122363f9caf4d0ed62b7c8b7501380e37ad1b971e94ac6cc54e7937827f844c615d71870123ed559e35d88cb8fcdf7db2a4d1c7c5617087d2a7bbe6bc4df0c59f33575c29720ab2416c504751"}}, 0x16b) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1377.087006][T26578] EXT4-fs (loop5): bad geometry: block count 546 exceeds size of device (512 blocks) 11:14:52 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {0x0}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:52 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000032402000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:52 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x0, 0x100000000, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:52 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x25d, 0x0, 0x0, 0x0) 11:14:52 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xb) setgroups(0x1, &(0x7f00000000c0)=[r5]) fstat(r1, &(0x7f0000002800)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = getgid() getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000002880)={{{@in=@local, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@local}}, &(0x7f0000002980)=0xe8) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f00000029c0)={0x4, 0x1, {}, {0xee00}, 0x8, 0x5}) newfstatat(0xffffffffffffff9c, &(0x7f0000002a00)='./file0\x00', &(0x7f0000002a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2000) r11 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$sock_cred(r11, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xb) setgroups(0x1, &(0x7f00000000c0)=[r12]) r13 = geteuid() setresuid(r13, 0x0, 0xee00) r14 = getgid() syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000240)="cfaa98409764cd49ee565489492cac2029c19d4997ca4bd2414210ef6fc8f68c42f0b73a8984cef7a622ed7c0415de3473e188ba7e625e9b07b19a9ef4ec387c768633376c31da60e81f1a4a556ab66b65974b02162a89823efaaf6459caf0568f6a5aee92d6bb34d326409c343dff9e745859974371afcc270fe4d29ca78bdda3bd42629d5813f91b432344f676e7aab2f11ceddbc379604a88207288713227df2b1d1e4c3583ae76889a09bcbb59834c0279734de116f802d5451401d3196a52f1d016b8b3312dfdc571e9fe4e23ca9804553d45defc73823ee5bcebe0978fb63afe2df6bfdd9e543f7ebc74d85780c18ab7fd3f57c9b29d124f451d48c277d594f213b3553046c61128515576f6d03c164e27bda7f1b88671b7eb4d0411f11943c037a1b602c768259bc15aa7ac7866d4fd6558090f734b3360b6ad7bcb3ef986f10573af84c19f2521803e76e547020a118081420d111495b27266c18ec610248187bbbeae84c3b01342604b31998aefba8df522a9211740a0a3826d2be5708f79a8646fb32fb5a57577a45a706d5f66fac6b0246bf1d2194ed73e702949faf9e1be42ee4df76d24301becbb34d2585e99610752363685be0b0de51054c14147d7ecc4fcdba83e698c157c1dcad50e96b4d1c8ff0e78afce8cadd5fbd567da61d156ef03a1b616d6060e1775743fa1d8703ec9a60cec747fbb0931751065b76ea54e1bd3033577ec8b87c79ccd0ed932057914d64385e4fbe9b40951567482e1e716ec1e18788b2d2c9da79af5d6904c9b1d6013c1b408d575e2125725ffec552bdfa7a8cbdcb396545e40f7bf34dd1edb58ff6b78742288fe66855d50b4f29a4aa8e54f8bfb68691ffb9f12e2b787ae6d19510791efc6d4a0820b57d8748a422a4311c319504305bca4b961a19fc7f94af70ac30bbae14f446a64dcd6e7f4929e67f78a855311ec63a441f5db8ee145fcf7e9cb708bf11c8989e5dc12c43cb34d2c38c287095cc65a404be4afc81a9ade1a5e73c903b8223b29bc07fa6d9351f85129dcf92abcd2138223bda68758f74eac1a6864eb3e37498f804a9c546abef7bd734d5482740f8978c48bf95c6730e1f33031cb060bbc018c5be1071fffaa49be2c4604404a56e4e8032c1bef78d81f2df5e8929bb770e9187e3f29ab118f7991dc3eb115f48692eabb6ad7e689a3526a36705a69ee03db72a7026f95c9cf318ead30b13e854ad953dd7c2e8dcb41c10750d607126d1f546c00b004fbfb48e50fcf54cffa146295fa29b7cf3e4988a7834c21376583a4bb6920859f9b25b8febda78f84aae002d082e14923d9f106121fa9059b9ae9c35fc966cfbbecb362cdb8b6984f343b055fead517769cb3f641424ee1e39e49fc6addad77ca20589342428a11a37ea82d9adf832d7559d48d17a97695cdcb430ba951f24c06a1813ab6909a6760d1106e53364ab41cf5b30420ff10aa83da41801d6f89194d3aa43e1da5f00cd90a6f98d17da925b715b6b47b12be3bbfb30fd703bae4d894f650492f0e30969ea972bd7f018df27eca8482cd4337e92a2695b090c460cccf8e542ff26e3e3aa6d1557a8aa30f751148c8cf494665f0b596396effe2a433f0b16eb357ad26694f923f99bcfb06f5879548976646229009d7cf8a45a7514fb7bc9475674e2b18fdebfbd803fb61e0b97dba0111fe281f03a633de6855e031fe16733baff76e3501030308bffedb4887439a217b1ebf48881608dc876b41ae8c01dfde3a5206683227a306a1233e4f169119a28b4c0695cc85ceed98febc5a146aec72f50f33fbe9deb7a6afea47cedbe8e77e32a05c0bf251ee99f839125c7859a9003158c197b3e0a19cc0685338e268d582597b19b90f912caac18e85a4924a67af05a5eeb7657b86225a26778a60ecee9ef649779482dde1bb4dff4b2a47e9897c3f41908b6c9f351e285550592937be3623239f0940b18e5606e584169410f2128d768d693100ec1e56030fc023688a8ee04c96b804060329b23a3b30a19824c1284284d4a6fd5e627500112835405fe7e09dbf8681eceed64baafed075834cec90bf2eda5e88f10d3145d20ebfc957354300ce76476e235874bfaedf44838b80304b738e439d799dd6b12311ecd589866187733ecdb5cc5e70c1a8deeb3c4a186032dc8a40ac879e6f7947e0330671fe919f15cf96d2a1166f16ba02bb8e4bb436e838ac402e574d83cd5089f92c4fea43803aa535fddd0b796edf1d583bfb17c5e48dbd37b8bfc68a45bbfbfe66d87f587b3bbb82a98730744d737e2ce226a42f91b1d766924c34f197b36820faeeaa7b4feb1466ad1f528db16e9e93cd75dcdc132f7914b04960d4b00a3c2c4bc56e244bb24d1c40d8f0d93adca3b673b2b99c11e3356276c4822b3f2db9fb261af204602caffa3badee26d5cce1b68a7052551ed76557d76678795a1f0f193e529633f5b0e47098f7f1f0d579c2bf2d7daee269691d098708df547bb536748c1af1c653dc7c661327be452800dacd814bf0d58d9f7129c88ecf5ad1a1625ba63d5b168851df31738af0f450ab46f6a64220f600d417d39adb60154b5f414556b0c6d3f631c0c3480adeb9c57bdd8ad80a8a3d4ae86dcdd9037e2fb8bef5af72dd8664cb79594205a558c5469fd066ead8cd8e8b77249a3a4f371bbb1b4e66136059448b9da329552c446d04f32bc1c9fb1f033de69ff50749e0bae1ea5106684fcf58f5cc3e0b405a0bee5a559d8693faca14130318c9a362321750c53d90a412a90313a5651243321182776a74a384a25a3495ec984e305ad643762ef61875c09375f5281817e62e6d5dfe71b4200b50e00cc05ee1e55db74df5ff969d2a49bb5dfb79226e230cb1ba1a8fac57ce994e42344b28827ac5759dbf5751351a2d692b8e9413205d179fda7a58a217e6a892cd1a4462b0672381bc36c65e6a0f4ddb8520c5761b86f6f24f20c42ba3c4d1d6e1124685745e3ce6e190dcd668b2135f6c11b188b52399387340d896aa31f98a3db84056b905caa315d10d27d2d6d7e96a6ca45b0ef63c51bf4dd5bdd6ddb2c796417d38ddd280a2b012be8eed5811b43e9f3ee21c9cd312c34e9aff438c018014b3e5b304f6cb07e550aa5653035e1252464fcf86c150d3d67f8acff120b749423ab4eb0cf85e7824a835df8a6f912f1ea920aa52456d82e788b214c2c38e529da7a46e3cc86146031e683a9e00e57a752cbf0e7b22bd4d9088d2a34c11dd03586edfae84e4e78fdcfa4849a77de98c53a360fa23be28b39b728c3808bf8b7fbf4966fa6bf7c39019359a67bb55383ec6c3cb29d3495f157192b0881e988cfcbeef8ae280a28fd646cbd6faa030dec39d34eec3eb8785fb2b0990b6a3eafe0435f9b123b27eb1689345e13af1506f55a0c60a20872d90bb98657d531d7919f7e06a41bc2fa8d19c660bac16032c8d789a8d733efb26dc5e5c758d9b19c5629bf18988abaff69f52417b0d90aeb56988e5e02d3ff50a9c23cd2cef7bbc3ddc2ca1debe7369c01187ef919bd9360580108ecdd858146125a3e6299c61a1546ab1325b90bfa0598f4d3dc972031a2b125eaa9374e2797d236c355d7305c131faaf8e882fd7d71e84f064e14d1033f12387066c1444c1c817f9115364bcec2c2043c1e88ff8485318fef711a182507e801ef5b4727e12512630ed17a64e87c7a6194b8721ac0e3000ac0a71284db36854eaf83711f8068c544af1d6772dc93a7e21f8e95d713db0fc23bb835ac6d1d0532992ca0dd180c91e8ce2ebe8f8209ae33d70e529bb88abae4df15ec4e7636a559e18a5e15c42259a21bd2a3750dad5036e8be112e79c370dbdee384cf64e2d25cfaca3113ece482e13921911b7c2a83fa7412636e745c0adb1f5da53c252932646994639cc6aa512d0d5c44f72b6e8cd17520b06b52a9404d6b5a5b78ab9b208a951703eac5b736c529cd8c8b58f1cac2711904678d9458509bddfb3c6091f444df6dd57b59827f25b6feeb03f30ea3a66c2bb57203d20403ba24732ef2c7e5b3fede193e23eb6d60086a9266346dfd01dc69923ae477398294e5652444e6c421b450a959ccecc7d9134dd14745e906cad59d7e695ddee1c3045391f1eaab2c7d1c458e3802f6564989548bb62865c501273f8c478c9445937c17c53a44e59d9a9003b0ffc04e7c020dfa1e6e380f067148da28761ffd2fce1ed9325d880b998a1a379a4fd6f223339c77feeefe04d315ac85dc6c4bd80b1c2597454030731fee06e4c46be14d57b4616722d713c6b8b06b1da0269743c4278dc81da539f446167a4c54901dc07f3604c4340d04f1c4dfa32da1ceea3fbc6aecda968776af9a592073fcf3c8375685236ac5b7004e64ce62bb450c176a9afe1ed0bc8e644b0fbc8339a146b8262c326653ea8d44396308d9b7da0333bcd0313c9f8ad408f583d7bb03a7c9d2b6ae0cd87c25c1376491cd0a475e26cbb53bce17282ed4865821873196d1ba85ef4e72e83a9f50b4bcbf688ba53512cd347645ba937cb0ce1067b45c7e577d7c9ef75474f68cbdb6cf473243021e81d2c0593cb9207ef9a4cd4da5f4c9f9a8eee531cedb765c0ee12feda908a00eae2ae6b45efbc2245c0c03476c424d52f478ddb0c94ad416c759dea6e6ec69707cf69c3236da4db5a90db910aa3ac9237458e0e5effa313d2b528a2b3ec49b6ace639e9c5e19898398ffd75ebfa9d4418ea36d10e59c8df602a20aaa1e6b83d2615fc31275d2c896fad042b2ce52d6581ba66887a84a53c7d7fce11c74dd339503f00863879cb1dc862864c4081fed92afba7a81fa0eb92ae3c5d3b7f4e0cf7b356e2b0739dad3b896533bb9613adfc2b7b94adae2cd022c21d33a0e8da2e718e59c89e308975b699218aa60ae3694d358fe2a947ea05d09a11ebb12441dfea94be4a6119c49ea2ac1a48ae10b82fc5beb6eaaa96c8a8a77c4d2bb88134363235787c0b846126d6846ba1d9d09ee96d811a481204db377785cb1c1046eabde94df98be713cd1001e5bbcf77936faad5940cb62ae4020e8bbeda8042a5974634f437178bf04b93c8eb526ec0435765edb31c086c228c61878719dc2fd0b4586409d56ae89367cd1ce2675b1e8a0f32fffc3aeb78773dd059fbab188f32dec02fcef5f6a9015706808f1cc32f796b121d3b2c46f3e685bc0ced187fd446735b1ac7cdf66e56ec49530a183602cd878edc3336cb4a03a94a08ab8e4b7fa1c2c8febda124438f9c37980807cd2e681c7442dd10bb8cc595c81e8adcb8ba33a5600a81715de6bd11e3b2102a69292dd57c5b87c0282b2fa086fab62363657eb52e1232790aa68b084b95efe2cf432b9ba152db936c6439080b1ce2cf3698628af23b9a5461ac6dad12028466d298560ed034c017e9012f6335dcdd52af429cc49192f3c0114af5760afd250aaf5ba2f137e1c2e38b3478a7b054b7fe514951ce5850d061884e5bdeaea647484e53f3f58a88ab97b1777c41a93a928052ca8d50a73acf65fe0ee51b192aead63d2233de71f7755d0454a8a46bd836b8be771bc222bf0474160bd57f1df59ceb8e6acee4b87404fe9f05c71ecca97e2ac3d7e986c5b4f13067f2a82f33b9b5afb97865ce2749b9242a9fc835d9b417d618957b3c56c481dd97f40590b291811129f93c327f8a05291a7c86a9a391ef6e65e97839cc30b169709cc8dcdb105fe9defa782cb1598dc627b9d25b2a0db32282b71d590c30aba4319deeaebfa43e6c75417bccd828cb7cfea996737dad137017f6da35f864f20b7902c5cd05e2f62500c0fbcb8a4f49dd6ba7139e1d874b51c2318fd8246c593fee0f959f7e34c058d821e73b3cd96a18748c2a935633726459943eb0ded881377ec4448d438ff561f7e63937263b46858fe210f4a7d7056a19e2ba7912652f8de8f4a03c6d572ba57902ce81b0d6db0de139983606a50f791b5e1f2748c1496fe7336d943bae11d9484de71b86c1eedca8de3078892e65ce3fec5625fef63fafcd2bf7cfb669d1db0692018e5991f1c8d07d79c29da0aa00e56f6c974c4758fc987169cffdadaa267033710615ff677db3734612e5869eab6980bc402a6ffbb20ab7550af433148150ebd4929ce9416731f632b7cc4981f727a9e6dcd65a992863bcba7a268ed77d9945cb56907f241b36a9a24cc7bb055a8b7f7529debcc95384f6af5e340c6a1b94eecc312affffc5a42718a1bc6004f7f03aacd976d62eccc5e13a3c95db9a45fcafa30ee59fef6b38ae287a6920e1a5a393aacaca19fc57d085591bf2cde2b4c5bcd4f15ad548bac1619c519124557ceecad127d28137635b3c1847dd4ded5dcc0f53a9aff458fbe6637416cfcd2f63a4d69e8f555526edea8efa4aa27305a2f172cbc71d7453430476d062a8ec2190532255234d5e0508d4a5fc97b7398c396bb454250b5145f7025f8f35797bd86dfd59b936ba0730cf705ca37acc9b365824cf4ee489e3932552d2ec2ebf0b0a2d16cc272a571ec7d85b3687e5494d5baaf063db6667dc84b4a5e9655e0b16fd3d67117f988742e895b8fe867d5c27a5e45403ab26836b82f10c5652da6ce72fecd3b248d961d5a4306393d5d745facd79386c06840141532c755b55b8eaa94bb23bd6e49b73d8aa696dfd7c2d5d5f46e1659f5f351a13f767fee32376a23d1ea4e65494f95db31536ca56011a86517d2d9ed5050d003c99abef85d06f7b50b146f20bbf3281312bd7c02bf0b8a5c42f274ade0ec5ca9cdab6d0fb83a221a8dd1f85abecde2d4c013c38a5b23db9d3929a9322a306f9296be7416cdc023cc7b2a7978adb9de655c12d2a6ff4cbe48a5521bbe5753ff7a9e3d8ada1d42ca8316975447af44ddac893605149a2a39790e710c0185a81bb48e69756d5f92486f44e401a5dfb28adbfd91c250eb9620bb53c6d70d8179597eec09c09fe116b04fad30f641144d6957e1d8ca86161470d81687fd8a744e4c3a23dd527964aa221c7f2f5221f49dddf9b6ab6e82fd67b46c227e5f7072d751a97f3e012104944e962bad160dac93df1e3677b5eae4257830c59b393b285bef95d79b95de2f7bd7b8a486e684aaf7ce32e085e8d29c2654a1595adf59519a5d1719d6385e8a65ad9876ad3baf4a9d8dec7f3aa3b29167570035da3db599d46b37506c29dd5f644620e50806564497587318dc62459b3b95029247fb6eb338b913e51a7909f86c39913eef9f75974cb941e96ce67a8eb779faed35ae80f4212c12e0c98d721ab4a90b8203a32153ca8dfc151ba3d526cb05e132db9f46e820779f2b7db7cb54432dde4223ac7290ed19cc7bd30f8ad78dd063b52f7deb3f5cdba29a46f5f9590205217af7f4bffd19b038a7b990cae7b93ef7c72e358fe85b0b963500f9f4d8de19243ff8ef7769fb4b7032dabdf988ea66c8f470fd50c014ca974d573d2b189af3eb3f92c65db8ce7949d8edc4c33b93db8490480da6fcfb1be365b7ebae3e2ad0f96c7d184d9308c7d7bda0a61021503b91f68cf721a29c4ecd62ff28e5fa0b9b38ea843f87052fbfac8acd1199fef7d95df3cee566a7149b221dd7d4cf4c82f0a026f178a761db5bdbc1611d381572c88c83a38d8051f3f676fd466c9ea4b0d1f7dce5806d4ed705ec26a453d8a5e651e2253b35cd61c36d14aa893271955a87710bbc543d00c685d3a1fe14b708028bd3205de1f3d69067b80a06bd2cdd9210f70b09772d300d0964d8af5b8013827b03a286f97a6818de4e922d16e05d302883dbc8d40532632709280751e59b09997ceb170670e0b37a378a037aaf00493a13f9eab2019e296cbc6017dd533f89630a732d2d3a9bf4f8ad272b57297d5da05aa3e26a0244cae4d28ec43ad905f2870367bbed8b14f4b24705ced1baa46ff6674f1c9a93b581ba753518ea1d1b624c60c423bf67e2f4b5874820ab3105c6b07de4da53905e75478ba806ba70f5a13449fb065aca41bef265a209cf979db30b3f29bf52d81defe075b1a108fe060bb117c21a9b2a31ba1e56585081a34cec1746ea2b817a54ba4675e11cdecdbd3a6d29c9071b0775b9da7aee2b080d1341a3cab2cfc379408fe24114e0814be4479cfe2ca99a6b5e6c2ffa3e66117644bc8e0d1745a85d44e604f35a45f24dbb53115b5f7b1fcc25aa025276efc2a628b8e7eba08799a75e0a8ff60a999e422ce0acef3367d5e16e79dc07036601365534baedf267ed1a545c3da066b7e64ee2ac557788d962525d505129d388c913b72f16c70c573357866064e521c3b86aa51b28ead83c6d6aa88018f7dc7233f2a80f5d7c038a7178266c3e9e651ce3d6d4e15b40b5f281408b7a58bd3393b4e89bc69a90b70343fdd31986a0165819e0f7c95501cc10e0f5745cad4364da86f309a134abac0191a059e166992369ea70ab163a0b15df92388effdc545db5ec1b50adda842b31be8ce2c185abebfb532d8fdbce277e4040257d3706df87718f25fcb64f69e3bd16e942544856ae824eb76ca69eb3384d130a10a1fabf8c8cb797a842d42d07a3b81082bb7db4509b96cab8b48c1839828b6037b5b289fcc7b66bd44dd7b7f8ba9515fe77deb4a65ee624c8d0485d64fbe25533229acfcd7d98337f1b2031305ceea4c574598921256e541d509c01ee02c8141af097fef89c62b8a3df2f12d58a3dfb84154c790fa9c5638c0b09c0a920c51d6d2f0955b9cc465124853bff232ff4c61b604ce7816e6cbaeb22ca025ca48e68e285509c6ef802ce40fe20941e56b4a6872ed1e25c5ee7a265461208cf6b6984951f68beb9ceaaf0475b941ee5696fe0add67b845b1826d1bc94e7c58a760c004bd53737b5ab92f0d09b0af7e6c1186e055dacb880907f8521bdde11748ee7489350baa0a730359b9373ed88eec9b767c45727ebdc5b5a64c2056cad3422ab3dca6d366bef58a8aa0c5c7f4ed80d0bcbf01a06d76a8e13aab3614c04518315e3722e621d1ab7c53ae156dd5fa31d49273b3815f515bfcb539690668fac5019145ed7c6d068e3db971d053c3c8977aa262e9ae6a28886ee9fa950be628aab7bac65601c4fef10e02aa836f90c38864b19699acf601da00b390d79fcc4d8957242167c8a10605a8223e9f1e9c669800c04c9577a72601752b7d969d908c07bb16d269026ae5480418fa1c2b2158340d39fe0d3adddcbad958fd192ac4a1176b9eb6b0693af180000b2a85725aed8de73df19d2854d8fcf8c9aba359cc718c7c69ccab29111931783793666598a13162f312a09f9de0a91b0e0a1dd7ef35870f24667a0bb7591b866bb02ac9987dee2bf9e0f5009126742763885da83fd8f282278f2f6f98e48e9a40050f2db2fc1686c6837ca7500af697f31d1700a159cb62769d935f79281cd5763967abd7e235460abdfdc9c176bffae944ba91d75bf04e7e1ebe114e36a3ef2c2ed7108a71d1fc17a244414c2aec535a8fae0945df82aeb7e3c046a8ceda5e38a443dab3d11c73a47c67ff5bb45debeaf8475f3d7d931a417056146731ed2d00686f88cbe930e7745826319365819f3dd9abb835b46585e40befa29579a11feba051d91cf7a063cc55ba7ee151d84caebd572598243673766646a6ee435929dcd98eac9bb2dcd6e4dcbac94fd607ab9f8bf486f28e58caab44092b8a39cb581f83c45fc646cb861902cd335169dc89a134ffa62240deaf2fb733687bebe0a3356c380c26abea79637c6afbf7a1ec87ed5ce3f045faea8b10fb8e26b2c30d4f512a5cf08e8df542debc0f111d3eddc3219690327e1a0de823b0906387b7014a9baf0caf7f572bad0d7fbe2b88f617dd9a62429756a3a32f3339886612f8a740016ffd840377b415216b651f9704ca9097a2ababd478d3adb891f9d506e9f1165cba4c0b28d4f8357d2b1ec03cef9fd727957456b075a0ebaeca59ea2f85748449c0493b7cbe19161c7eb8e6a3707a54b0c33f1d27a64ec585331e5b85e6f9fb8b4edcf38c3125f6c00cdeeeccf0b984a773761f39a36ef3a94ede25ae98db20a5bbb715df269b91c8b87fe6084513235639ad8800ddb16a3cca6b0825d269e8b327a75994af281ca0cddf884178e3a94fd8c6057eb32853460ea67c14281a241a53c17b91775cdd9eb09a2b075cdf1b5a6f024c25159d1aa859c7c76b39c549744b6029af6d4507c818b12289fbdf64d2f8584b8872d9533c3def5710179058e3a990f4936d2969b2b0e1d970098f9a5e196f9fdecfd92bb2b4cbdf47b4d940c9ff4d828d0abfde6ab55abb4cc6e4db5a174b2367192376543b3d6cf7e0dfcb05ffa6ffc78272b78df30ba6151cd9ce13f8ca8e1bff6cd1f9dcc461b47eceb3f8f39df3ef4319f341ed32790fe2d1e3f3d2ae19711f4c666716204520b91eb9ed17fb4208698ae24bd080728b303719fa5074ecca44ab809db85b155fa964ffc3a712ca7fa1417dc0f6484d59fd1e17a60a4d407eca239e82e773cecc9ba1c082dd8561b75b8a0d2f00d8f5521bd3baaf0fdab309ea410822a7dc2565d2b4fe9f1ecec893f19bb61d758c193048c2677d73f2826a8e1c75befc812c0d699f15d00b057ff772eb3ccfa738e6f9fc9f7eb5c79ad5ef7ef93a6541d6939d7d58e1c4bb0afd2cd311b8e7c2c6e81e2578fbd75931cc9d9bf3e28efb19e2724d107f8a67c6ca7a92c630f61366c5630fbe792e4797fda26ab1a6f115591e9ebc5ddb3e107ccd06d0148e3d5ffb5c657e0e6655a49e726bc2f0d2843ac2396301f82e9e3fded6ee6954c99185d65d35c090464f616dacb7a95439ada5bbb0f7ffb480d9438cf1abe35ac8fe559eff85dafe14c203c53970ce66c7b0df52ce3353f9a96682fed971a3c1e3aa61d640bf851f4933f9fdbe05254e345b0e25868d2e3c78756625badaa57b0ac0a18ee46a79f60a374da7cfa5445cd780887eb1eb9a30768e24cc863192aabd429d84c2a5f113eeee971084321fc6324b76234c0e1420bad277422b4c4b5c97eaff6dddef7c99b250c6072f13c9eeb911af8a3121e36eec473783e13ae2a2bcfb3f1da2dd52b2e378e2b24e3d53e5036ee56a76ddf368a223bf3c2b6bccd46456d2efc9272e56bbf4adb05a9cdffbc743093e43113fbfd865a3272c7d2aa05b88dff50fff47dd5345e96245f012dfa904cef2ce3e148c9646f660342e2a60e12cb94bd0ccd0cdc879a4d2a8f017b554a4c3b6527e538df60860f6b47d8ac2a7b4e35862b00537ec7c149c70f8be0a28facba6f6fade3f0d602f3c052790089904dc80b0b7c44736c9e953effe862519c21bb7ee8ecf78b9b24a182770e7c21ccec9d5d7af0ab1d781db654a5055312ca4b66c505d47b296cc73f9c8dfbd2df532236b7668e2ced0c9ac2b4c168e537f3ec625d3b0a47b39d11f8e9a21ae800b2f9ec8ba7ae44aeb5f39b9ed6f575860b87c6c2b0c7d6782ee7e61aac12890b5aaa6cb64737c721d69bd952ba9640639a62c658c47800f1a77ffabdc2eae97e38a09f15c688a3b9732976fc4c8700d2f56a1c1685c10c668bb0cb4dcd8b643d6bc6b9455ddfc8ebbddddf4029fe0d051f785d8ea8c2aab0bd8f572d87805a5f2b3a020", 0x2000, &(0x7f0000003080)={&(0x7f0000002240)={0x50, 0x0, 0xb3, {0x7, 0x1f, 0x2, 0x800, 0x1, 0x3, 0x7ff, 0xffffb5fb}}, &(0x7f0000000100)={0x18, 0x0, 0xdbd5, {0x48f}}, &(0x7f0000000180)={0x18, 0x0, 0x8, {0x7}}, &(0x7f00000022c0)={0x18, 0x0, 0xad8, {0x8}}, &(0x7f0000002300)={0x18, 0xffffffffffffffda, 0x4f93, {0x6}}, &(0x7f0000002340)={0x28, 0x0, 0x7, {{0xc924, 0x81, 0x1}}}, &(0x7f0000002380)={0x60, 0x0, 0x18df, {{0x3, 0xfffffffeffffffff, 0x4, 0x7fffffff, 0xffff, 0x8ba, 0x9, 0x7ff}}}, &(0x7f0000002400)={0x18, 0x0, 0x57e, {0x2}}, &(0x7f0000002440)={0x12, 0x0, 0x6350, {'+\x00'}}, &(0x7f0000002480)={0x20, 0x0, 0x1, {0x0, 0x3}}, &(0x7f0000002580)={0x78, 0x0, 0x7, {0x7ff, 0x3, 0x0, {0x6, 0x6, 0x8, 0x200000000000000, 0x4, 0x3, 0x20, 0x3, 0xffff, 0x4000, 0x7, 0xee00, 0x0, 0x0, 0x8}}}, &(0x7f0000002600)={0x90, 0x0, 0x8000, {0x1, 0x0, 0x101, 0x1, 0xf76, 0x2, {0x1, 0x81, 0x6, 0x81, 0x0, 0x73f7, 0x52, 0x6, 0xa0, 0xc000, 0x200, 0xffffffffffffffff, 0x0, 0x3, 0x1}}}, &(0x7f00000026c0)={0xb0, 0x0, 0x81, [{0x2, 0x10001, 0xb, 0x5a8cd7cb, '#}).@$+!\'+:'}, {0x6, 0x6, 0x7, 0x2, '@(!-:\'['}, {0x2, 0x4, 0x1, 0x7, '^'}, {0x4, 0xffffffff, 0x1, 0x1, '\x00'}, {0x6, 0x0, 0x0, 0x2}]}, &(0x7f0000002ac0)={0x468, 0x0, 0xfffffffffffffb3e, [{{0x5, 0x2, 0x6, 0x0, 0x2f, 0x5, {0x4, 0x3800000000000000, 0x2, 0x3c, 0x9, 0x5, 0x6, 0x9, 0x90e, 0x4b37d66707552dfc, 0x8001, 0x0, 0x0, 0x2, 0x8}}, {0x4, 0x3, 0x1, 0x80000001, '%'}}, {{0x0, 0x8, 0x3, 0x3, 0xdf0, 0x0, {0x6, 0x100000001, 0xf54, 0x6f, 0x7, 0x8, 0xfffffff8, 0xffffffff, 0xaf, 0xa000, 0xfff, 0xee01, r5, 0x912, 0x5}}, {0x6, 0x603, 0x4, 0xa, '$-[]'}}, {{0x4, 0x2, 0x401, 0x4, 0x5, 0x81, {0x6, 0x4, 0x8, 0x80000001, 0x1, 0x200, 0x86, 0xffff, 0xb1af, 0x6000, 0x5, r6, 0xee00, 0x3, 0x4}}, {0x5, 0x8000, 0x3, 0x4, '(:)'}}, {{0x6, 0x3, 0x4, 0x8, 0x80000000, 0x7, {0x4, 0x4, 0x200, 0x10001, 0x0, 0x4, 0x100, 0x5, 0x1, 0x8000, 0x64f, 0x0, r7, 0x3, 0x4}}, {0x3, 0x800, 0x0, 0x7fff}}, {{0x2, 0x0, 0xffffffffffffffff, 0x1, 0x996f, 0x200, {0x5, 0x5, 0x7, 0x0, 0x81, 0xca, 0xfff, 0x6, 0x1, 0x1000, 0x3a, r8, 0xee00, 0x80000001, 0x6b}}, {0x4, 0x0, 0x3, 0x200, '.:['}}, {{0x2, 0x3, 0x2, 0x7, 0x4, 0x4ae, {0x1, 0x5, 0x8000, 0x6, 0x40, 0x200, 0x8, 0x5, 0xefc, 0x1000, 0x5, r9, r10, 0x6}}, {0x6, 0x2c, 0x5, 0x7fff, '$/,\xd3^'}}, {{0x4, 0x0, 0xa4d, 0xf0, 0xa70, 0x5d, {0x5, 0x4, 0x7, 0x5c7, 0x0, 0x8ed, 0x4, 0x3, 0x80000001, 0x4000, 0x80, 0xee00, r12, 0x5, 0x7fffffff}}, {0x4, 0xffff, 0x3, 0xb8, '$\xd4:'}}]}, &(0x7f0000002f80)={0xa0, 0xfffffffffffffffe, 0x7fff, {{0x5, 0x1, 0x80000001, 0x3, 0x4, 0x401, {0x5, 0x6, 0x100000001, 0x4a, 0x3, 0x200, 0x9, 0x1000, 0x7, 0x4000, 0x40, r13, r14, 0x6, 0x3}}, {0x0, 0x18}}}, &(0x7f0000003040)={0x20, 0x0, 0x8, {0x9, 0x4, 0xffffffff, 0x2}}}) [ 1379.255459][T26599] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1379.283989][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1379.329124][T26606] EXT4-fs (loop5): bad geometry: block count 548 exceeds size of device (512 blocks) [ 1379.352893][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:14:52 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000002502000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1379.367672][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1379.380048][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1379.392346][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1379.460549][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1379.517499][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1379.550694][T26622] EXT4-fs (loop5): bad geometry: block count 549 exceeds size of device (512 blocks) 11:14:52 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000002702000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1379.584888][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 11:14:52 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r3, &(0x7f0000000200), 0x400086) close(r3) write$P9_RWRITE(r3, &(0x7f0000000100)={0xb, 0x77, 0x2, 0x4}, 0xb) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_setup(0x87, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f00000002c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) r6 = signalfd(r0, &(0x7f0000000180)={[0x1ff]}, 0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r6, 0x84, 0x1, &(0x7f0000000240)={0x0, 0x9, 0x1, 0x7, 0x1, 0x1000}, &(0x7f0000000280)=0x14) ioctl$CHAR_RAW_RRPART(0xffffffffffffffff, 0x125f, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) ioctl$HIDIOCGNAME(r3, 0x80404806, &(0x7f0000000300)) syz_io_uring_submit(r2, r5, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd=r0, 0x0, 0x0, 0x1, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:52 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x25e, 0x0, 0x0, 0x0) [ 1379.645360][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1379.681979][T26599] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1379.719118][T26635] EXT4-fs (loop5): bad geometry: block count 551 exceeds size of device (512 blocks) 11:14:53 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000002e02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:53 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) getsockopt$inet6_mreq(r4, 0x29, 0x1c, &(0x7f0000000100)={@private2}, &(0x7f0000000180)=0x14) close(r4) setsockopt$CAN_RAW_ERR_FILTER(r4, 0x65, 0x2, &(0x7f0000000000)=0xffff8001, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:53 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1380.149763][T26671] EXT4-fs (loop5): bad geometry: block count 558 exceeds size of device (512 blocks) 11:14:55 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:55 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x25f, 0x0, 0x0, 0x0) 11:14:55 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x0, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:55 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000003202000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:55 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = fsmount(0xffffffffffffffff, 0x0, 0x81) ioctl$RTC_AIE_ON(r1, 0x7001) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1382.298963][T26694] EXT4-fs (loop5): bad geometry: block count 562 exceeds size of device (512 blocks) 11:14:55 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000023502000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1382.388554][T26700] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1382.405203][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:14:55 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000003d02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1382.444523][T26712] EXT4-fs (loop5): bad geometry: block count 565 exceeds size of device (512 blocks) [ 1382.455267][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1382.480727][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:14:55 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080)={0x0, 0x0, 0x2}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x108, &(0x7f0000000140)=0x3085, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) ioctl$KVM_GET_CPUID2(r4, 0xc008ae91, &(0x7f00000002c0)=ANY=[@ANYBLOB="010000000000000000000000000000000000000000000000000000000000000000000000000000000000000090bd94b237e64978483400000000"]) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x30, 0x0, 0x1, 0x70bd2c, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x2, 0x9, 0x800, 0x10001}}}, ["", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x8}, 0x4014) [ 1382.526533][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1382.564495][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1382.607772][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1382.632820][T26724] EXT4-fs (loop5): bad geometry: block count 573 exceeds size of device (512 blocks) [ 1382.648167][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 11:14:55 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000003f02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1382.683952][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1382.747280][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 11:14:55 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x260, 0x0, 0x0, 0x0) [ 1382.800518][T26700] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1382.822899][T26738] EXT4-fs (loop5): bad geometry: block count 575 exceeds size of device (512 blocks) 11:14:55 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000180)={r1, 0x9, 0x3ff, 0x6}) setsockopt$inet6_tcp_buf(r4, 0x6, 0xfddc394443e0d5b2, &(0x7f0000000380)="e00533d9346e9080f39f2fc56f732895a62b460380f6dfdbaa97293854fad188ee852dd868e2ee71c1ca194c27d217525aff83d64fcd6352a0e839bf43c745c8c53e33168b730398e6c4d428d069a8ce2e0f78092fa0a8f56565d0a0d417a23c4b17fb3ba449af0ff2ae2fff925f4ed9d4b9db09a573ea3bbad67f58218d89474a1701053a33658687d1fb14a16cc833876f432b1591a051aa5ff592d07ae7024f891b6af01b91f03c2876c1e43615703cba2cb8360ea6690019e78c623807cf65f8248d28bc223e557a2475969f3ad4aa95477f77384054cd918b1dc567e6274b400a6d17ab1e79af62eedcb1cc79702d0977bce513091bb6c58b6cf7a689a3c6fa235d8ca00c0656a960c8e45b0f165e1091165fb3de07fad44bab927728a535f08140f1e09311eed690fb4bfcc3c444e0a6e208bca7e3bdc97541c022df77a28502c95b485e0122b5f481d5c735684925caab7b447ffa8e4ceee0bcc8cf397e075b8818d5f8eddd4d2bde81e4f810c25af1d5a63b318552f33b4eaf9bf2a35b4313a2d470903c5cc71e97fa3c407f0dc7b0bab6d6c26b910217fc0f069f43937ba41fa290542a40049483193b67e9c0885b99e3edd97a866699987a59ed786a8abf458e0f4ec8e5e122cc94008268cc8df7abbba41ae10a871cfb4438ce1ed1fbdc5d075832296f21791532ec3a371e93fcf8bc84fc3c7cf8fc8c3bf92057c9b603e35852c802b7bc4b3ae6e3364638793109a604e8415822a5120c71af1e48f0ca94f9498b70e0d868899eb1e2768985400c149af06284018a597a67f0928b4157090a504cf40ed9e817985b34f0f9b10ad71184f662b3f2fa8325b520166d7dfeff1a0bc57399be115d54e45e7664c40adc7ef8b1a38507857fd9526ce695f03259b894adf24f6b3f6320c7ed4da3de19627037c230259686625f400506be40dd3c2eba6ea930652be866b7d4ce520b85d3c04a86ba8f11a4689abb78b200bbc400e393fdcb28b6662cf7c932c232459464b8784b099e6439435a1e48cd7fcd9231df202aa1b2069cbd680d6c568e1426f1eea8a9dc8865b34a9019ef8ac139feec134d743865f2b9e0c351695d11f56e39f2ffbcc91c9e48ae72edb39c3f5d065ac6c9423dbc7c983cb247455ab3906f42cc3a9d58016cf62ef084d82db793f258b732139fc573de3b25f4d81d9b02fe3d1c136c03ba9a46dfbd21fffbea1c0f96771e8b4d0c13bbdedf34cb7e26fe935eb2f813bf47e469a4d57c899367e605fcbc120aa0791502d17c9d16b0c73cd23b165f786abcc5adff85003e90d3a5a874abcf39e5e619175c2994a84f2b88eb5981adb4fdf51e46e7b036f053d5ae949da9b9376307bbef264c93cc3b0cf1916a3c151850be630415c7ea6d8e0545e868d448b5a8d0bcfc34809b9d559430884907a18bbca4c902abc4085100d13234c98143d3eae01ce8cd85f703af131cd3e1daecc8fb9ffe8b3439b0cad3e7d03afd4940c7a1aa3f6bddaff5567f293609c1fee0aa4dc5d878dc74816517558fee779afe630c7a7a82281a2bbbf6c1b38caedcb36e9098c1ff1935464ba1d49fe65790e51523bf06d52cc3f46737741c26b69a5f60e36fb226c7508e53146ef1938ca73e69f398af6e0856b8f31319a8f21997ad748fa2046f7c396c2fa1f21f45dc8c63548644a5dd455bbaf03741dd7cbaf9a232ecd7e09d3c1149ab16cc2a87056546204dbb077c9acc0fac5518e08a13965a5cbc6a8d3ac978b97a612b3f4b49ffe90868bbfec624dcb538106d1ea858a09779db3e571e5b7586a25b95716cb603764bbb22cfb2696299d6a30b5605f41407fd62fb85848289fdaa036ad71cb775d7b8f0b1052b83fe6c72fc187c35f37694496506e482c6fbf7c2d64dbc68e8e229825c546196e0eae1d7f42b7c80dc2043dbeb722ec412420ab67c30bfa09ffc51ecd48352a1c26b9ea35d9743d8d8564daf32c208b4481a7690a6947b76ec7fdd9d1c6007eed90e95e906a4de345fc645966a608edd5f8c2fe6aaa70c00aa4cab4d3902803f9571118acba4f05d62eff8660f218b859a675ab6da535074f4d885ef3fff92bf7d71ddc7d1155f883afe7805673225ac521756a3133c1ddc4725a0fbd6d26c5eb6668f6a419dfd7a62a97753c42e69fe4c241a450cb515935428d97d5ff555b447f01ed5cee481cbed64b77341da68b6639f53ecab51a0f4aead4c6b051deaabd1165538b6f5fc4258cc8d277653b51bf26d6bfb784200e50a3c2c3c1a2202190362994d5606d5066f8a6de62626570c5ae83be1a9265f450220f32ebc085afb4a0945b9c99903a17a8cc44c8cd20f86db7335728b2dd24121191eee5a712ee5633d70f6b9dc9e3d75cd292b62f5d8e4635a73ac3e969256ce5e2a5211e5e2b7f88a4825a85e33badd5dbb3be5fb019a75dbbdb35e6a8a47ee48051c2515f6b7488ece912bf67a060e5438685ff126590f0bc4f135c3a9ec3078676c9d17a02d020b0a69bcbc2f3773f49a2f9dda42e9972395305c61e3da06c5fdfe986a0baf5907155186ea31cf8df65ac554409292c6909b35a2f86b87303484052f49570382724ba9048bdcb38a090a09d59258b3248b90b663f641454241d5f6e3751ad9f7a7a67b6897ea5985a1b5077b72405e8e8905f5e3c8738b0ae5d52908f5d9c06ff3bedfed002c54590a1e5629418ddd8447b34924a1b5ba165144b4fd92fd928548e6318a0763c6b8b66383f53ff4f4e15bff46447644861f9f4f867fc38bb9cf453268d8ba166f77123a16c440aaf4f90341c55667fed2b72e4a8fbf389cc405137e1a4aa243639e3bf838df2dca3ed2bf1f7426a66d6686ecf155c866dfff68a5f4cb9614f708b3750fd2cc2cf5ffba31f2b511c8bcd9831f41d3311d1ad75aa9ad60d54dbe46caff2b0c2023efa616b3bdefa5d75e26a812e69ac5e7ff0f03a3586d4b0281a585a839ec3854f5a91bd8155fe5216823d82b04e0db41f10f1ab3f5d1546170a3eeb9959a244d7366fe12ecb2307d2b3e825f1e14fcd126884ead5fd3d9649361efc159170471ab3c5fc2df6a318ef5db02a675237414ed5ff3d9806a3e21e30e87a479bb08b2adf000f0435e748bec6d02e4f37ea5f758f7577aa8564d197db4108d8575add6d0e5a20a26db8e380019906b40f61e1f3bf5fe3fbd0a5e5909785f7c7bd662cebf77373a860a481de3657dbc2952a90d132e7c42b6d951c4e4e234af17544aa14b4359dc523361296ac667ddc720b7aee3ee8a02579a1444839a373f5a27ce33b78fb2175c0bcb6095ac8ed01c512217db3735e445e8e620de6d7ae17b458beb410e1bc8948e30f4eeb11eec15d704d882f7b52642d11b1459dc18725ba1ba1e2b8932afe35233373c7668ecb82d042ffccd6e1364739c624db835dc2473548f63ec19e9e201cc44ebc49574c788605b742eaeab6be3f50d4180e50caf4ab6cdc811ea8490e4608066254f5d9a5c30228ca598a66babf65ee5720fb7ec6ef0e655e7805c6f8c1ec0a5879ae6b68e6a869740d961ea14dcbb8c5a23aec16938acfdc03db188e1ab14141fcaa3317868606044bf1d6b1012abe39b1be0401f919d02f4897b89fa4f964b038183369718d55b1a888b442aee7899e1d8a1f38b6162a3ddf1cbc8ad0212173ac881ce195f6bf7bca33131a7ae0ec333e78608fb7fec55adf754596c8f538764596c3644ac6beba9b410932aa228fda1262dbee103fad83d29a7db539ad8edddfb59468cbfd5f58532df10b89ff17d067694f9d851f3d512812b030a4afa88f5cb1b76ea5b549f679071562d034dea706cce61ffdc55058f07c30a51055e311aabe9ec8b8ca7dce2c5df56e446d12355dfe4f7bfa9a4898bb884599b28219d67d12dcce940166ea494e02f48f0b2219549f3fdbbff16c2f602b9cb1ba2d1968e0098d2367d260bf09abd1cc7038f229cc3435e392b16506034027cdf9cff18e6800f5ee617ea95596e32d1d614cd4b5c9107f8e46ee8bbfd25af67d263ef91294c189811aa9c57a11caed627070b8b76b7445730e81ee22ef6293c7ac5917341f011d9b209921ad1f0ae2daa317336bb1471c081e5f7ae44850644f5540def647eed4e7690e7e863408142f0981d72241c558015c07664a79d8febdb19349e0cd692e51bef2c2b0af7c614ea2a286702d6466102d69c62bb3024ff8721f1fe085d82a666d85f4dbab6499526655e3a498c068ba7a9b7310f91a831891c82478b419812fbeea571f79f1cf7f5fe75dad344f6a12179a303888d77e1fb8ddc76b70a107c5e16734470a16e9cc129e4517b9bafe289034538f5752aa27d4769b472f95ea08f5cb8bbe8079fad723e8171279d6d7e4ecc6dd216b6debef097b954e5434895636a0528945f0fc4448eef49b4d80e82d0bea75d9453a590813b1b2b551ae8bdc0904962a24c623a4e25a82d8f2230306b4f0b87a34d79a87d417d77b73e4a09d856411136d0c931336dedefc7067179afd833c4d92f082e4503af583ba6ea6fe080b73208d9ce3699eadc678593df8d640745da225e5033a43db18cc16f0c8a0d6dc14617ccc44fa2b01e9325361b64aa60b19c7762929d2fff533b35a3d3934a7d9e3d64efa261d17a9989bd203b7163efc4b8f323a32642f0866aa6eebbe1fc75190b93f9e3a4e549774de3866c1059b31b034b34acbfa21f5afefd65883a6f31e028fdd4cb0fe84e6abf9457f01d4934e643736d603bd693dce943556957be653b1166f6e527afa2b94f9dd9410394792dfc2b4d2a2a6615247e4a4dab44fff7c998f752706c93105eb7ef997922e8d6e1aa96a4c842d64d3e8fae9e81164755e565f5d61f50bd4a8cd908bf372e77c1123f36e6389c9422ff163cdf9e83244c30d5e188052f36508e260f7ffd1b58fe63e629311549fb2b5e1e57976c9197f72117cad08bfb6518746ca0332f8e70041c06cb1d10b9a3b09f8311138491f4914814ddf8a482354d7178588b24e854c1e246daf3db7e7a0519a66050055661901aceafb9388d516a588941ed4fbdb799d8d43bb7f96ac6d64880aa652cd2e8b801d5b995c9d3250159a48b03f130e32762f0b9a606542b6b96f6012c69ec0cefa6dde3906556394c6eaf2d39f78ad06268c49eded7e1b48b197059ae569f1908be9e9e9aeaec544b67a01af9303448452fbe0d21f4edb4fdc5d0b14d39097ea192cab136523a8158bf652c1c1cd0e3b428fb1cd4950fe7769e721c51549a997deaa79e46aa7d2a846bb4ee4a616f41cca9c5288618866a527be441f83cbeaca16005338b6b636ea459ed4088c8d8e1a27ec5654479093ce28f2cabeb3c08e5b21653d7954e4327919f6689838c336a28552243e527e985e5a5ad1e42fa04690bf4ea1fa9297468576d9e393fde6a5da76a3d2d00eddccb02f719f84e775d2b79dfefa100079c1ae56a6db6c5c9d633995578384c32f8d2783d8e475e973cad8264c6df5c08d7cfc5f454163c9ecddbd0a7990186b7a846c0b7149ee91af4ffe96dfbbe8183bc2a2cd8fcf6c5beaf53350c0ad24a5a8d0bae496506a2349f65286d2c93d930dd3c1fbc5927a16b823d64e40537127129ce5d4202bb9673db351fc68ff101fb44b2a0c63b4c5e54e914c67a16f5c97111934f02b6019a8f61660a64a01798f3ab97c9096b7eba1a25948d4bf7aafbce42b1ac33088cc19f102ec608749b84953653c9bc98ebe21ab4c9f7f14d391031e36626a7dc462807b1809afd37aa48155d3a140bb52c1b5e5302cdf21d1c34f225a0c7", 0x1000) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:56 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:58 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:14:58 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:14:58 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x261, 0x0, 0x0, 0x0) 11:14:58 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x0, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:14:58 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r5, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r5, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r6 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r7 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r6, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) setsockopt$netrom_NETROM_IDLE(r7, 0x103, 0x7, &(0x7f0000000440)=0x7, 0x4) shmctl$IPC_RMID(r6, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$BLKGETSIZE(r7, 0x1260, &(0x7f0000000480)) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1385.362388][T26791] EXT4-fs (loop5): bad geometry: block count 576 exceeds size of device (512 blocks) [ 1385.390853][T26795] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:14:58 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x800}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0x8, 0x12) [ 1385.417364][ T34] audit: type=1800 audit(1603883698.350:255): pid=26801 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=2 res=0 errno=0 [ 1385.452620][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:14:58 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004802000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1385.472933][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:14:58 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x262, 0x0, 0x0, 0x0) [ 1385.529032][ T34] audit: type=1800 audit(1603883698.350:256): pid=26801 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=3 res=0 errno=0 11:14:58 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$SNDRV_PCM_IOCTL_INFO(0xffffffffffffffff, 0x81204101, &(0x7f0000000240)) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:14:58 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004a02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1385.578053][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1385.605612][T26827] EXT4-fs (loop5): bad geometry: block count 584 exceeds size of device (512 blocks) [ 1385.693966][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:14:58 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004b02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1385.777127][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1385.810109][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1385.837892][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1385.886216][T26847] EXT4-fs (loop5): bad geometry: block count 587 exceeds size of device (512 blocks) [ 1385.897118][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1385.946757][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1386.025301][T26795] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:14:59 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a505000000007751e8ba63b66788a341cda555fedbe9d8f3b423cdacfa7e32fe0231368b2264f9c504c98d8665522be18bd10a48b043d2c42646d25dfd73d06d7535f7866970e9f03d124cecabeeb01faa50761cb052c41cfb94d0293bfae5ca5c9f07dc6751df1394e757fa1bd904006271d065a0e3ccae6603173a649c1cfd2114dc4b95fbbf0f8b6587d452d64e7cc957d73578f4c35235138d5521f9453559bea8a860e8efbc6f2b2a3e3173d5de1b5e64a6ec7ae0dab5d91cec3da386628d91ecda46c4b8ac49a510ce03cf02a76d33ad825bc8f83ab944422a9cee74bfee13454d6b821e0513a808c80597086bfce8cb8dc1576f07571d31a77a454943b2f1af914bd087ed1835f230d4ba77aced55f58843593a22c52d6fb77163cc049fb6022007c44df77593b2881adf24012cf069532607d68c894ac400"/371], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:01 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:01 executing program 0: r0 = open_tree(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x80000) write$FUSE_ATTR(r0, &(0x7f0000000240)={0x78, 0x0, 0x0, {0x8, 0x30bfc480, 0x0, {0x6, 0x3, 0x2, 0x5, 0x7fffffff, 0x7, 0x3ff, 0x9, 0x34d1, 0x2000, 0x8, 0xee01, 0x0, 0x5, 0x80}}}, 0x78) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r1}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:15:01 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004c02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:01 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x263, 0x0, 0x0, 0x0) 11:15:01 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x0, 0x3, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1388.401284][T26871] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1388.423526][T26874] EXT4-fs (loop5): bad geometry: block count 588 exceeds size of device (512 blocks) [ 1388.449482][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1388.502401][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1388.538492][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:15:01 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000005c02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1388.611382][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1388.656755][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1388.690788][T26891] EXT4-fs (loop5): bad geometry: block count 604 exceeds size of device (512 blocks) 11:15:01 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000006002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1388.719001][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 11:15:01 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x264, 0x0, 0x0, 0x0) 11:15:01 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x9, 0x0, {0x0, 0x0, r0}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_GET(r5, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @dev={0xfe, 0x80, [], 0xf}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4048000}, 0x4000844) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x40a00, 0x0) [ 1388.803197][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1388.826073][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1388.867220][T26904] EXT4-fs (loop5): bad geometry: block count 608 exceeds size of device (512 blocks) [ 1388.877141][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1388.892339][T26871] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:01 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x265, 0x0, 0x0, 0x0) 11:15:01 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000026002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1389.080356][T26930] EXT4-fs (loop5): bad geometry: block count 608 exceeds size of device (512 blocks) 11:15:02 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000000)='sys_exit\x00', r1}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:04 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:04 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x368c, &(0x7f0000000280), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsa\x00', 0x321900, 0x0) ioctl$SNDRV_PCM_IOCTL_XRUN(r4, 0x4148, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r5, 0x40305829, &(0x7f0000000040)) close(r5) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000000380)=ANY=[@ANYBLOB="2652ef2c000000040000000093c39337670c07621efa3cc10000000000000006ff0700000000000000000001000000040000000ed5000093ffb9d0589cce38c5b7b98005fe0261eefa85231e8b9cfcc640bb284f7e40c506c68b257f629ba4cdef4ff16b5cbc0271e907b0095858f59471c9b097c2f9c976116eb3661323f5f190"], 0x2c) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) r6 = socket$kcm(0x29, 0x3, 0x0) fcntl$setflags(r6, 0x2, 0x1) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x131501, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000180)={0x3, 0x3, 0x0, 0x6, 0x1, 0x0, 0x6, 0x2}, &(0x7f0000000240)=0x20) 11:15:04 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000036602000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:04 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x0, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:04 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x266, 0x0, 0x0, 0x0) [ 1391.446647][T26957] EXT4-fs (loop5): bad geometry: block count 614 exceeds size of device (512 blocks) [ 1391.462255][T26959] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:15:04 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000006802000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1391.518838][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1391.573650][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1391.605005][T26979] EXT4-fs (loop5): bad geometry: block count 616 exceeds size of device (512 blocks) 11:15:04 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000006c02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:04 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x267, 0x0, 0x0, 0x0) [ 1391.679964][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1391.698011][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1391.716151][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1391.758738][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1391.789954][T26988] EXT4-fs (loop5): bad geometry: block count 620 exceeds size of device (512 blocks) 11:15:04 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000007402000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1391.822586][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 11:15:04 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305829, &(0x7f0000000040)) close(r1) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000240), &(0x7f0000000280)=0x4) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) r3 = pidfd_getfd(r1, r1, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f00000002c0)={0x1, 0x3f, 0x9, 0x0, 0x6}) setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000180)=@ccm_128={{0x303}, "8f730863eedf310f", "a398bb30afaece806a32ca257bac648a", "4de5dcd6", "49d6fe093bd6dc33"}, 0x28) io_uring_enter(0xffffffffffffffff, 0x450c, 0x3a, 0x0, 0x0, 0x0) write$P9_RATTACH(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x69, 0x2, {0x0, 0x1}}, 0x14) [ 1391.889888][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1391.933745][T27000] EXT4-fs (loop5): bad geometry: block count 628 exceeds size of device (512 blocks) [ 1391.959696][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 11:15:04 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) write(r0, &(0x7f0000000000)="982836f7d749b0f22e0ad16c5d576af6741526a6a2", 0x15) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000240)={'security\x00'}, &(0x7f0000000100)=0x54) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000180), 0x8) [ 1392.001255][T26959] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:05 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:07 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:07 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x268, 0x0, 0x0, 0x0) 11:15:07 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x408000, 0x0) ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_setup(0x87, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000340)) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @local, 0x4}, {0xa, 0x0, 0x0, @mcast1}, r8}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000002c0)={0x3, 0x40, 0xfa12, {{0x2, 0x2, 0x0, @private1}, {0x2, 0x0, 0xfff7fdc0, @loopback}, r8}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r6, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {r8, 0x5}}, 0x10) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:15:07 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x0, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:07 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000007502000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1394.480691][T27037] EXT4-fs (loop5): bad geometry: block count 629 exceeds size of device (512 blocks) [ 1394.521684][T27039] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1394.556920][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:15:07 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000007a02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1394.654781][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1394.682755][T27060] EXT4-fs (loop5): bad geometry: block count 634 exceeds size of device (512 blocks) [ 1394.719764][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1394.757416][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:15:07 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000007e02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:07 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x269, 0x0, 0x0, 0x0) 11:15:07 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x408000, 0x0) ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1) r2 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_setup(0x87, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000340)) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000180)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @local, 0x4}, {0xa, 0x0, 0x0, @mcast1}, r8}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f00000002c0)={0x3, 0x40, 0xfa12, {{0x2, 0x2, 0x0, @private1}, {0x2, 0x0, 0xfff7fdc0, @loopback}, r8}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r6, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {r8, 0x5}}, 0x10) syz_io_uring_submit(r3, r5, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r2, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r2, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1394.781341][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1394.820009][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1394.861034][T27082] EXT4-fs (loop5): bad geometry: block count 638 exceeds size of device (512 blocks) [ 1394.883501][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1394.920620][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1394.940125][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1394.960705][T27039] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:07 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x26a, 0x0, 0x0, 0x0) 11:15:08 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000009002000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1395.095872][T27112] EXT4-fs (loop5): bad geometry: block count 656 exceeds size of device (512 blocks) 11:15:08 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:08 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000003c102000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1395.421347][T27121] EXT4-fs (loop5): bad geometry: block count 705 exceeds size of device (512 blocks) 11:15:10 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x265, 0x0, 0x0, 0x0) 11:15:10 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x26b, 0x0, 0x0, 0x0) 11:15:10 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x0, 0xe90, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:10 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000cb02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1397.531496][T27138] EXT4-fs (loop5): bad geometry: block count 715 exceeds size of device (512 blocks) [ 1397.557498][T27142] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:15:10 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000cc02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:10 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:10 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000cd02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1397.741560][T27156] EXT4-fs (loop5): bad geometry: block count 716 exceeds size of device (512 blocks) 11:15:10 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x26c, 0x0, 0x0, 0x0) 11:15:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x400086) close(r4) io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x9, 0x0, {0x0, 0x0, r0}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x1c, 0x14, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x2c, 0x2, 'syz2\x00'}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_GET(r5, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x0, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @dev={0xfe, 0x80, [], 0xf}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4048000}, 0x4000844) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x40a00, 0x0) [ 1397.860855][T27160] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1397.965182][T27173] EXT4-fs (loop5): bad geometry: block count 717 exceeds size of device (512 blocks) 11:15:11 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:11 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1398.401344][T27201] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1398.412805][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1398.436880][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1398.458850][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1398.478268][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1398.496214][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1398.524568][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1398.550188][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1398.567703][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1398.586674][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1398.605828][T27201] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:13 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:13 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000ce02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:13 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x26d, 0x0, 0x0, 0x0) 11:15:13 executing program 0: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004802000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:13 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x8, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1400.560666][T27223] EXT4-fs (loop5): bad geometry: block count 718 exceeds size of device (512 blocks) [ 1400.563258][T27222] EXT4-fs (loop0): bad geometry: block count 584 exceeds size of device (512 blocks) [ 1400.580919][T27219] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1400.592320][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:15:13 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000cf02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1400.610828][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1400.626352][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:15:13 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r5, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r5, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r6 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r7 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r6, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) setsockopt$netrom_NETROM_IDLE(r7, 0x103, 0x7, &(0x7f0000000440)=0x7, 0x4) shmctl$IPC_RMID(r6, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$BLKGETSIZE(r7, 0x1260, &(0x7f0000000480)) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1400.693441][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1400.784700][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1400.796843][ T34] audit: type=1800 audit(1603883713.711:257): pid=27244 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=4 res=0 errno=0 [ 1400.825598][T27248] EXT4-fs (loop5): bad geometry: block count 719 exceeds size of device (512 blocks) 11:15:13 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r5, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r5, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r6 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r7 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r6, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) setsockopt$netrom_NETROM_IDLE(r7, 0x103, 0x7, &(0x7f0000000440)=0x7, 0x4) shmctl$IPC_RMID(r6, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$BLKGETSIZE(r7, 0x1260, &(0x7f0000000480)) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) 11:15:13 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000fc02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1400.894219][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 11:15:13 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r5, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r5, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r6 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r7 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r6, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) setsockopt$netrom_NETROM_IDLE(r7, 0x103, 0x7, &(0x7f0000000440)=0x7, 0x4) shmctl$IPC_RMID(r6, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$BLKGETSIZE(r7, 0x1260, &(0x7f0000000480)) io_uring_enter(r1, 0x450c, 0x3a, 0x0, 0x0, 0x0) [ 1400.936541][ T34] audit: type=1800 audit(1603883713.861:258): pid=27254 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=5 res=0 errno=0 [ 1400.960123][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1400.981262][T27264] EXT4-fs (loop5): bad geometry: block count 764 exceeds size of device (512 blocks) [ 1401.016399][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1401.028725][ T34] audit: type=1800 audit(1603883713.921:259): pid=27262 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=6 res=0 errno=0 [ 1401.053815][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1401.067100][T27219] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:14 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:14 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r5, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r5, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r6 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r7 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r6, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) setsockopt$netrom_NETROM_IDLE(r7, 0x103, 0x7, &(0x7f0000000440)=0x7, 0x4) shmctl$IPC_RMID(r6, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) ioctl$BLKGETSIZE(r7, 0x1260, &(0x7f0000000480)) [ 1401.429607][ T34] audit: type=1800 audit(1603883714.351:260): pid=27279 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=7 res=0 errno=0 11:15:16 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:16 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x26e, 0x0, 0x0, 0x0) 11:15:16 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000fff02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:16 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:16 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r5, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r5, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r6 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r7 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r6, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) setsockopt$netrom_NETROM_IDLE(r7, 0x103, 0x7, &(0x7f0000000440)=0x7, 0x4) shmctl$IPC_RMID(r6, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) 11:15:16 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r3, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r3, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r4 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r5 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r4, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) setsockopt$netrom_NETROM_IDLE(r5, 0x103, 0x7, &(0x7f0000000440)=0x7, 0x4) shmctl$IPC_RMID(r4, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) 11:15:16 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000004000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1403.584055][T27294] EXT4-fs (loop5): bad geometry: block count 767 exceeds size of device (512 blocks) [ 1403.605590][ T34] audit: type=1800 audit(1603883716.531:261): pid=27297 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=8 res=0 errno=0 [ 1403.679934][T27296] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1403.711929][T27318] EXT4-fs (loop5): bad geometry: block count 1024 exceeds size of device (512 blocks) 11:15:16 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000010000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:16 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x3, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:16 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r2, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r2, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r3 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r4 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r3, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) setsockopt$netrom_NETROM_IDLE(r4, 0x103, 0x7, &(0x7f0000000440)=0x7, 0x4) shmctl$IPC_RMID(r3, 0x0) [ 1403.747828][ T34] audit: type=1800 audit(1603883716.671:262): pid=27320 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=9 res=0 errno=0 [ 1403.879503][T27331] EXT4-fs (loop5): bad geometry: block count 4096 exceeds size of device (512 blocks) [ 1403.888092][T27332] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1403.900092][ T34] audit: type=1800 audit(1603883716.821:263): pid=27330 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=10 res=0 errno=0 [ 1403.929359][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1403.970804][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1404.025822][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1404.057774][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1404.070165][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1404.096854][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1404.115774][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1404.133129][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1404.150297][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1404.167997][T27332] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:17 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:17 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r2, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r2, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r3 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r4 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmat(r3, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff) shmctl$IPC_RMID(r3, 0x0) [ 1404.471498][ T34] audit: type=1800 audit(1603883717.392:264): pid=27353 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="SYSV00000000" dev="hugetlbfs" ino=11 res=0 errno=0 11:15:19 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000040)}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:19 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x26f, 0x0, 0x0, 0x0) 11:15:19 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000010019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:19 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r2, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r2, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r3 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) r4 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000280)=0xffffffffffffffff, 0x4) shmctl$IPC_RMID(r3, 0x0) 11:15:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r2, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r2, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r3 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) pidfd_getfd(0xffffffffffffffff, r0, 0x0) shmctl$IPC_RMID(r3, 0x0) [ 1406.631627][T27368] EXT4-fs (loop5): bad geometry: block count 65536 exceeds size of device (512 blocks) 11:15:19 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="20000000000e010019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:19 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0xcd000000, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1406.757809][T27377] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1406.791360][T27393] EXT4-fs (loop5): bad geometry: block count 69120 exceeds size of device (512 blocks) 11:15:19 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r2 = shmget$private(0x0, 0x1000, 0x54001800, &(0x7f0000fff000/0x1000)=nil) shmctl$IPC_RMID(r2, 0x0) 11:15:19 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x270, 0x0, 0x0, 0x0) [ 1407.006453][T27416] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1407.033074][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1407.061835][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1407.075626][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1407.088505][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1407.117851][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1407.171300][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1407.213801][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1407.245016][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1407.273820][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1407.287214][T27416] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:20 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:20 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000020019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1407.481421][T27433] EXT4-fs (loop5): bad geometry: block count 131072 exceeds size of device (512 blocks) 11:15:22 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:22 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x271, 0x0, 0x0, 0x0) 11:15:22 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000030019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:22 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:22 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:22 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000040019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1409.674673][T27447] EXT4-fs (loop5): bad geometry: block count 196608 exceeds size of device (512 blocks) [ 1409.698126][T27450] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:15:22 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1409.751650][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:15:22 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x272, 0x0, 0x0, 0x0) [ 1409.823965][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1409.843153][T27472] EXT4-fs (loop5): bad geometry: block count 262144 exceeds size of device (512 blocks) 11:15:22 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1409.864711][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1409.916413][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1409.971811][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1410.038896][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1410.074622][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1410.112733][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1410.161274][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1410.185501][T27450] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:23 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:23 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000050019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:23 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x273, 0x0, 0x0, 0x0) 11:15:23 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1410.582340][T27514] EXT4-fs (loop5): bad geometry: block count 327680 exceeds size of device (512 blocks) 11:15:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:23 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:23 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000060019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1410.733324][T27540] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:15:23 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1410.795544][T27554] EXT4-fs (loop5): bad geometry: block count 393216 exceeds size of device (512 blocks) [ 1410.937155][T27565] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1410.950593][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1410.967400][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1410.981128][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1411.029610][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1411.063650][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1411.086660][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1411.103458][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1411.121115][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1411.137757][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1411.154292][T27565] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:26 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:26 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x274, 0x0, 0x0, 0x0) 11:15:26 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000070019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:26 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1413.559877][T27580] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1413.576376][T27585] EXT4-fs (loop5): bad geometry: block count 458752 exceeds size of device (512 blocks) [ 1413.590883][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 11:15:26 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000080019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1413.637949][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1413.655545][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:15:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, 0x0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1413.717632][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:15:26 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 1413.785581][T27606] EXT4-fs (loop5): bad geometry: block count 524288 exceeds size of device (512 blocks) [ 1413.797429][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:15:26 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, 0x0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:26 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000090019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1413.845528][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1413.863042][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 11:15:26 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x275, 0x0, 0x0, 0x0) [ 1413.948526][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1413.992129][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1414.009833][T27580] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, 0x0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1414.033897][T27633] EXT4-fs (loop5): bad geometry: block count 589824 exceeds size of device (512 blocks) 11:15:29 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:29 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000000000a0019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:29 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x276, 0x0, 0x0, 0x0) 11:15:29 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1416.599102][T27662] EXT4-fs (loop5): bad geometry: block count 655360 exceeds size of device (512 blocks) [ 1416.620454][T27664] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:15:29 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="2000000000000b0019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1416.663168][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1416.769029][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 11:15:29 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1416.819448][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1416.826189][T27691] EXT4-fs (loop5): bad geometry: block count 720896 exceeds size of device (512 blocks) [ 1416.934640][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 11:15:29 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1417.000170][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:15:30 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x277, 0x0, 0x0, 0x0) 11:15:30 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000400019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1417.077944][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1417.122264][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1417.168632][T27715] EXT4-fs (loop5): bad geometry: block count 4194304 exceeds size of device (512 blocks) [ 1417.173217][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1417.214522][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1417.245095][T27664] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1417.259433][T27715] EXT4-fs (loop5): bad geometry: block count 4194304 exceeds size of device (512 blocks) 11:15:32 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:32 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000410019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:32 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x278, 0x0, 0x0, 0x0) 11:15:32 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:32 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1419.618324][T27738] EXT4-fs (loop5): bad geometry: block count 4259840 exceeds size of device (512 blocks) 11:15:32 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000420019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1419.711790][T27744] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1419.757290][T27759] EXT4-fs (loop5): bad geometry: block count 4325376 exceeds size of device (512 blocks) 11:15:32 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:32 executing program 0: syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:32 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:32 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000000430019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:32 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x279, 0x0, 0x0, 0x0) [ 1419.964030][T27774] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1419.979256][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1419.991259][T27779] EXT4-fs (loop5): bad geometry: block count 4390912 exceeds size of device (512 blocks) [ 1420.024821][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1420.037806][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1420.050314][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1420.068394][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1420.081039][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1420.094467][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1420.106982][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1420.123883][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1420.136391][T27774] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:35 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:35 executing program 0: syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:35 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000200000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:35 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x27a, 0x0, 0x0, 0x0) 11:15:35 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1422.671866][T27812] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 not in group (block 3)! [ 1422.703993][T27812] EXT4-fs (loop5): group descriptors corrupted! 11:15:35 executing program 0: syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1422.718635][T27815] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:15:35 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:35 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:35 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000300000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:35 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:35 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x27b, 0x0, 0x0, 0x0) [ 1422.930589][T27843] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1422.949545][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1422.977317][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1423.021475][T27853] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 not in group (block 3)! 11:15:36 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1423.053614][T27853] EXT4-fs (loop5): group descriptors corrupted! [ 1423.060805][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1423.095196][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1423.139703][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1423.158190][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1423.183835][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1423.209391][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1423.235646][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1423.254123][T27843] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:38 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:38 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 11:15:38 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x27c, 0x0, 0x0, 0x0) 11:15:38 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000400000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:38 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x0, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1425.682015][T27889] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1425.694894][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1425.719743][T27890] EXT4-fs (loop5): ext4_check_descriptors: Inode bitmap for group 0 not in group (block 4)! [ 1425.726303][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1425.743815][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1425.756495][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1425.770294][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:15:38 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1425.781001][T27890] EXT4-fs (loop5): group descriptors corrupted! [ 1425.784842][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1425.801535][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1425.817195][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1425.830005][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1425.848895][T27889] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:38 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000500000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1426.007108][T27916] EXT4-fs (loop5): ext4_check_descriptors: Inode table for group 0 not in group (block 5)! [ 1426.017482][T27916] EXT4-fs (loop5): group descriptors corrupted! 11:15:39 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:39 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x27d, 0x0, 0x0, 0x0) 11:15:39 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000600000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:39 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1426.241507][T27940] EXT4-fs (loop5): ext4_check_descriptors: Inode table for group 0 not in group (block 5)! [ 1426.251925][T27940] EXT4-fs (loop5): group descriptors corrupted! 11:15:39 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000700000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1426.451188][T27952] EXT4-fs (loop5): ext4_check_descriptors: Inode table for group 0 not in group (block 5)! [ 1426.489396][T27952] EXT4-fs (loop5): group descriptors corrupted! 11:15:41 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 11:15:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:41 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x0, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:41 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x27e, 0x0, 0x0, 0x0) 11:15:41 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000800000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:41 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1428.742779][T27972] EXT4-fs (loop5): ext4_check_descriptors: Inode table for group 0 not in group (block 5)! [ 1428.754554][T27972] EXT4-fs (loop5): group descriptors corrupted! [ 1428.814986][T27976] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1428.885997][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1428.952473][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1429.000229][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1429.052739][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1429.071345][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1429.086009][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 11:15:42 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:42 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000900000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1429.098312][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1429.124638][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 11:15:42 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x27f, 0x0, 0x0, 0x0) 11:15:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1429.166453][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1429.196064][T27976] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1429.241618][T28006] EXT4-fs warning (device loop5): ext4_multi_mount_protect:286: Invalid MMP block in superblock 11:15:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:44 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 11:15:44 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000a00000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:44 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:44 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x280, 0x0, 0x0, 0x0) 11:15:44 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x0, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:44 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, 0x0, &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1431.814149][T28042] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1431.851616][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1431.866388][T28045] EXT4-fs warning (device loop5): ext4_multi_mount_protect:286: Invalid MMP block in superblock [ 1431.941324][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1431.955583][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1431.968572][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1431.981362][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1432.002344][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1432.029379][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1432.049868][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1432.076639][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1432.090849][T28042] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:45 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:45 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x281, 0x0, 0x0, 0x0) 11:15:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, 0x0, &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:45 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000b00000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, 0x0, &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1432.319146][T28079] EXT4-fs warning (device loop5): ext4_multi_mount_protect:286: Invalid MMP block in superblock 11:15:47 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 11:15:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:47 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0x0, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:47 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004100000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:47 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x282, 0x0, 0x0, 0x0) [ 1434.804224][T28112] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1434.820658][T28117] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz-executor.5: bad orphan inode 17 11:15:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1434.848534][T28117] ext4_test_bit(bit=16, block=4) = 0 [ 1434.859800][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1434.871598][T28117] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 1434.881276][T28117] ext4 filesystem being mounted at /root/syzkaller-testdir055970571/syzkaller.A9UWO7/2174/file0 supports timestamps until 2038 (0x7fffffff) [ 1434.907038][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1434.973262][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1435.016070][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1435.046156][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1435.071276][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1435.088156][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1435.100888][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1435.116704][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1435.131714][T28112] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:48 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:48 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004200000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:48 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x283, 0x0, 0x0, 0x0) [ 1435.371039][T28160] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz-executor.5: bad orphan inode 17 11:15:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:48 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x284, 0x0, 0x0, 0x0) [ 1435.498958][T28160] ext4_test_bit(bit=16, block=4) = 0 [ 1435.516103][T28160] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 1435.532540][T28160] ext4 filesystem being mounted at /root/syzkaller-testdir055970571/syzkaller.A9UWO7/2175/file0 supports timestamps until 2038 (0x7fffffff) 11:15:48 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:50 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 11:15:50 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004300000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:50 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0x0, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:50 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x285, 0x0, 0x0, 0x0) [ 1437.881491][T28208] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1437.894886][T28209] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz-executor.5: bad orphan inode 17 [ 1437.918194][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1437.938872][T28209] ext4_test_bit(bit=16, block=4) = 0 [ 1437.963016][T28209] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 1437.975417][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1437.999709][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1438.016731][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1438.018171][T28209] ext4 filesystem being mounted at /root/syzkaller-testdir055970571/syzkaller.A9UWO7/2176/file0 supports timestamps until 2038 (0x7fffffff) [ 1438.036368][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1438.065866][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1438.084253][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1438.100862][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1438.117909][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1438.135196][T28208] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:51 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x286, 0x0, 0x0, 0x0) 11:15:51 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:51 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000007800000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r0, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1438.374173][T28235] EXT4-fs error (device loop5): ext4_orphan_get:1411: comm syz-executor.5: bad orphan inode 17 [ 1438.412458][T28235] ext4_test_bit(bit=16, block=4) = 0 [ 1438.418075][T28235] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue [ 1438.431485][T28235] ext4 filesystem being mounted at /root/syzkaller-testdir055970571/syzkaller.A9UWO7/2177/file0 supports timestamps until 2038 (0x7fffffff) 11:15:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:51 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000202000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1438.639016][T28267] EXT4-fs (loop5): bad geometry: block count 514 exceeds size of device (512 blocks) 11:15:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:53 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000302000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:53 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x287, 0x0, 0x0, 0x0) 11:15:53 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0x0, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:53 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)="97d138dfe019fd586a5dedfa22443b665f07000005eb3014203873bc3376", 0x1e}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 11:15:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000004300000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1440.904577][T28287] EXT4-fs (loop5): bad geometry: block count 515 exceeds size of device (512 blocks) [ 1440.914382][T28286] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1440.931066][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1441.004785][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1441.035818][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1441.052851][T28303] EXT4-fs error (device loop4): ext4_orphan_get:1411: comm syz-executor.4: bad orphan inode 17 [ 1441.072912][T28303] ext4_test_bit(bit=16, block=4) = 0 [ 1441.078394][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1441.099900][T28303] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 1441.121279][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1441.137808][T28303] ext4 filesystem being mounted at /root/syzkaller-testdir454807985/syzkaller.Knyg7X/1741/file0 supports timestamps until 2038 (0x7fffffff) [ 1441.161877][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1441.181035][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1441.214075][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1441.227143][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1441.239868][T28286] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:54 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:54 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000402000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:54 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x288, 0x0, 0x0, 0x0) 11:15:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000900000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000900000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1441.375095][T28325] EXT4-fs warning (device loop4): ext4_multi_mount_protect:286: Invalid MMP block in superblock [ 1441.444801][T28331] EXT4-fs (loop5): bad geometry: block count 516 exceeds size of device (512 blocks) 11:15:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:54 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000502000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1441.646673][T28343] EXT4-fs warning (device loop4): ext4_multi_mount_protect:286: Invalid MMP block in superblock [ 1441.703753][T28355] EXT4-fs (loop5): bad geometry: block count 517 exceeds size of device (512 blocks) 11:15:54 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:54 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x289, 0x0, 0x0, 0x0) 11:15:54 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1441.907145][T28379] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1441.925963][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1441.978857][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1442.010939][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1442.029274][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1442.045991][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1442.058870][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1442.073349][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1442.089504][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1442.102001][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1442.114490][T28379] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:15:57 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:15:57 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000602000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:15:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000502000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:57 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x28a, 0x0, 0x0, 0x0) 11:15:57 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1444.445507][T28404] EXT4-fs (loop5): bad geometry: block count 518 exceeds size of device (512 blocks) [ 1444.454649][T28411] EXT4-fs (loop4): bad geometry: block count 517 exceeds size of device (512 blocks) 11:15:57 executing program 4: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0x0, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1444.501413][T28413] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:15:57 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:15:57 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000702000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:15:57 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1444.709041][T28435] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue 11:15:57 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x28b, 0x0, 0x0, 0x0) [ 1444.749243][T28449] EXT4-fs (loop5): bad geometry: block count 519 exceeds size of device (512 blocks) [ 1444.777010][T28452] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1444.813729][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1444.848467][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1444.910776][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1444.945186][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1444.986654][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1445.011174][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1445.038635][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1445.066547][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1445.085770][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1445.104550][T28452] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:16:00 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:16:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:16:00 executing program 4: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0x0, 0x8001}}, {0x0, 0x1ff, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:16:00 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000802000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:16:00 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x28c, 0x0, 0x0, 0x0) 11:16:00 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x0, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:16:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, 0x0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:16:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, 0x0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1447.530759][T28490] EXT4-fs (loop5): bad geometry: block count 520 exceeds size of device (512 blocks) [ 1447.549141][T28491] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 1447.575007][T28486] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:16:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, 0x0, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1447.608875][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 128 [ 1447.646024][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 129 11:16:00 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000902000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:16:00 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x0, 0xa, 0x80000001, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1447.686028][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 130 [ 1447.729915][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 131 [ 1447.765428][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 132 11:16:00 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1447.808289][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 133 [ 1447.823387][T28525] EXT4-fs (loop5): bad geometry: block count 521 exceeds size of device (512 blocks) [ 1447.843550][T28531] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1447.846800][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 134 [ 1447.924693][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1448.043013][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 135 [ 1448.044041][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1448.056218][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 136 [ 1448.079762][T28491] EXT4-fs error (device loop4): ext4_group_add_blocks:5609: comm syz-executor.4: bit already cleared for block 137 [ 1448.104111][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1448.137947][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1448.187331][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1448.204898][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1448.250291][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1448.271332][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1448.287704][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1448.305018][T28531] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:16:03 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:16:03 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000a02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:16:03 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x28d, 0x0, 0x0, 0x0) 11:16:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:16:03 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000702000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:16:03 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x0, 0xa, 0x0, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1450.582483][T28561] EXT4-fs (loop5): bad geometry: block count 522 exceeds size of device (512 blocks) 11:16:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x5c, r1, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x5c}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:16:03 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000b02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1450.673576][T28567] EXT4-fs (loop4): bad geometry: block count 519 exceeds size of device (512 blocks) [ 1450.684174][T28568] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue 11:16:03 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000500000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:16:03 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x48, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x48}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:16:03 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x0, 0xa, 0x0, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x4f0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) [ 1450.778025][T28589] EXT4-fs (loop5): bad geometry: block count 523 exceeds size of device (512 blocks) 11:16:03 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000c02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1450.953979][T28612] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1450.970505][T28614] EXT4-fs (loop5): bad geometry: block count 524 exceeds size of device (512 blocks) [ 1450.983437][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1450.995716][T28617] EXT4-fs (loop4): ext4_check_descriptors: Inode table for group 0 not in group (block 5)! [ 1451.005719][T28617] EXT4-fs (loop4): group descriptors corrupted! [ 1451.015073][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1451.029804][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 [ 1451.042284][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1451.059573][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 [ 1451.089114][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1451.108917][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1451.125717][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 [ 1451.138123][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1451.153176][T28612] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 11:16:06 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000040)}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 11:16:06 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x28e, 0x0, 0x0, 0x0) 11:16:06 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000500000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:16:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x48, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x48}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:16:06 executing program 1: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x4000000040000, 0x4, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000d3f4655fd4f4655f0100ffff53ef010001000000d3f4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010300)="020000000300000004", 0x9, 0x800}, {&(0x7f0000010400)="ffffff03", 0x4, 0x1000}, {&(0x7f0000011500)="ed41000000080000d302005ff4f4655fd3f4655f000000000000040004", 0x1d, 0x2200}], 0x0, &(0x7f0000000240)=ANY=[]) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) write$cgroup_int(r1, 0x0, 0x0) close(0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000280)={0x2020, 0x0, 0x0}, 0x2020) setresuid(0x0, 0x0, 0xee00) r3 = geteuid() write$FUSE_DIRENTPLUS(r1, &(0x7f00000022c0)={0x1f8, 0x0, r2, [{{0x0, 0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x1eda2b92, 0x100000000, 0x3, 0x0, 0x0, 0x0, 0x0, 0xffff, 0xa000, 0x7f, 0x0, 0xffffffffffffffff, 0xbf, 0x8001}}, {0x0, 0x0, 0xa, 0x0, '/%*{\xa7-%,]{'}}, {{0x3, 0x3, 0x0, 0x9, 0x7fff, 0x7, {0x6, 0x40, 0x7fff, 0x2, 0x7, 0x0, 0x1fffc00, 0xd2c4, 0x3, 0xc000, 0x1, 0xee00, 0xee01, 0x6e97}}, {0x0, 0xfffffffffffffffc}}, {{0x2, 0x2, 0x4, 0x0, 0x7e0000, 0x0, {0x0, 0x8, 0x0, 0x101, 0x0, 0x7, 0x2, 0x0, 0x10001, 0x6000, 0x3f, r3, 0xee00, 0x0, 0x1ff}}, {0x4, 0x1, 0xb, 0xe1, '\\]/$,\\{#]\'#'}}]}, 0x1f8) r4 = msgget$private(0x0, 0x0) msgsnd(r4, &(0x7f0000000080)={0x0, "90e6782a54e00aff21f59f73868c8e54d5c16df779c90eb3d0dce13585bd1eff5e1e6def2454f99be165077e3e5e73cb3743c3b3697f5ac4a3443cf5e3ac51b9edbca487521c7f0c3f5b4b888bf9bac4865929e7a3693c021ffc3d9dfda2451048c5891e58c582c5480a1e8812eb9d3a33f5f7bc1eabed6e44be1f7a78a00b7ed8fd8129282c105cc23db0"}, 0x93, 0x800) msgctl$IPC_STAT(r4, 0x2, &(0x7f0000000140)=""/99) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x75e) 11:16:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000d02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1453.652021][T28636] EXT4-fs (loop4): ext4_check_descriptors: Inode table for group 0 not in group (block 5)! [ 1453.687490][T28641] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 1453.692426][T28636] EXT4-fs (loop4): group descriptors corrupted! [ 1453.700505][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 128 [ 1453.711537][T28643] EXT4-fs (loop5): bad geometry: block count 525 exceeds size of device (512 blocks) [ 1453.716554][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 129 [ 1453.738306][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 130 11:16:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x48, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x48}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) [ 1453.793477][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 131 [ 1453.826546][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 132 11:16:06 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000500000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) 11:16:06 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x54, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x54}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:16:06 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x80009, 0x6, &(0x7f00000005c0)=[{&(0x7f0000000040)="200000000e02000019000000500100000f000000000000000000000004000000000002000020000020000000d8f4655fd8f4655f0100ffff53ef010001000000d7f4655f000000000000000001000000000000000b0000008000000018000000c20500002b02", 0x66, 0x400}, {&(0x7f0000010100)="0000e3310000000011000000b138543112eb43ac9dbc7e1411f64d55010040", 0x1f, 0x4e0}, {&(0x7f0000010200)="010000000000050040", 0x9, 0x560}, {&(0x7f0000010300)="030000000400000005", 0x9, 0x800}, {&(0x7f0000010d00)="ed41000000040000d7f4655fd8f4655fd8f4655f000000000000040020", 0x1d, 0x1480}, {&(0x7f00000000c0)="504d4d00504d4dff", 0x8, 0x10000}], 0x0, &(0x7f0000000140)) [ 1453.864942][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 133 [ 1453.940035][T28666] EXT4-fs (loop4): ext4_check_descriptors: Inode table for group 0 not in group (block 5)! [ 1453.970850][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 134 [ 1453.978682][T28666] EXT4-fs (loop4): group descriptors corrupted! [ 1454.002830][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 135 11:16:07 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0), &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140)='l2tp\x00') sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x54, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @loopback}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}]}, 0x54}, 0x1, 0x4c000000}, 0x0) sendmsg$L2TP_CMD_SESSION_CREATE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="480000009aefb6f21f6edf724cb3d10f5591d777f67751a10a0236f37e3c2bc9df66643b3015ed936518bd7ed256384d3a71be91e1c9791a9c6b5b847303fc0f445a859590c6d002a60802a9b39eff2d4a97822441146bfe0ba2248dbae2a277fddedfe5c89852baf5f044796cdfaf091625c740797f8089b1fdc0d5e7f1c10508abd08c2fe82ab95b7818bcc019ad9eaaf33865273f71b7e0f0b2a36b297f2a540efb989a3c510a68cdc181aaa184ccd5efaebe", @ANYRES16=r1, @ANYBLOB="00082bbd7000fedbdf2505000000080019007f0000011400080076657468315f746f5f6261746164760008000b000200000008001800ac1414aa0500070003000000"], 0x48}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) shmctl$IPC_RMID(0x0, 0x0) 11:16:07 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_io_uring_setup(0x7b8a, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f00000001c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x3081, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, r0}}, 0x0) io_uring_enter(r1, 0x450c, 0x28f, 0x0, 0x0, 0x0) [ 1454.042962][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 136 [ 1454.067502][T28641] EXT4-fs error (device loop1): ext4_group_add_blocks:5609: comm syz-executor.1: bit already cleared for block 137 [ 1454.084486][T28670] EXT4-fs (loop5): bad geometry: block count 526 exceeds size of device (512 blocks) [ 1454.125283][T28684] ==================================================================