last executing test programs:

5.3307715s ago: executing program 0 (id=28):
faccessat(0xffffffffffffffff, &(0x7f0000000000), 0x0)

5.270920999s ago: executing program 0 (id=31):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp1', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp1', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp1', 0x800, 0x0)

5.212101919s ago: executing program 2 (id=37):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock', 0x800, 0x0)

5.211952301s ago: executing program 2 (id=40):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/binder', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/binder', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/binder', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/binder', 0x800, 0x0)

5.196268117s ago: executing program 2 (id=41):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem', 0x1, 0x0)

642.504051ms ago: executing program 1 (id=49):
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000209c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x400, &(0x7f00000000c0)={[{@iocharset={'iocharset', 0x3d, 'utf8'}}, {@shortname_lower}, {@fat=@codepage={'codepage', 0x3d, '737'}}, {@shortname_win95}, {@rodir}, {@utf8no}, {@uni_xlate}, {@uni_xlate}, {@shortname_mixed}, {@fat=@codepage={'codepage', 0x3d, '874'}}]}, 0x1, 0x227, &(0x7f0000020a40)="$eJzs3TFrE2EYB/AnbaqxIOkgFEXwxMUptBX3iigIBQXJ4GaxLUpTCxYC7dDq5JfQr6Cja8FBXP0CIkgVXOzWQYi0FxtT0zYlXK7Y32/Jw+X93/u+R8iRIc89vLgwP7O4NLe5uRGlUiGKkzEZW4UYiYEYjNTzAAD+J1uNRvxspPJeCwDQH+7/AHDydHn/v9fHJQEAGev69/9A35YEAGTs/oNGIa2SUsTCy3q1Xk1f06M35uJJ1GI2xqIcvyIau9L69p2pW2PJtm8jUV1Ya+bX6tXB9vx4lGOkc348SbXnh2K4mf88HLMxEeU41zk/0TF/Kq5e+Wv+SpTj06NYjFrMxHa2lV8dT5Kbd6f25E/vjAMAAAAAAAAAAAAAAAAAAAAAgCxUkl0d+/dUKvu9n+YLO/11itGpP9B6W3+gvf15inGhmO/eAQAAAAAAAAAAAAAAAAAA4LhYWl6Zn67VZp8dVDz9+Ob9YWO6LArNeXs9T+/F2ctfX+0/5sVRrk8vRemfI+uX8rwsXRYfNh6fv7Y0ev24rGd5ZX7ooI/Wj3JERrO/zXXvf3Z96ODR15PT71a/fO/2zDl8GQEAAAAAAAAAAAAAAAAAwAnX+tPvUVJnslsQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOSg9fz/7Iq89wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL8DAAD///T/nmA=")

519.717264ms ago: executing program 1 (id=50):
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='fd\x00')
getdents(r0, &(0x7f0000001ec0)=""/4108, 0x100c)
getdents64(r0, 0x0, 0x0)

438.183132ms ago: executing program 1 (id=51):
r0 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00')
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x33ed0000)
getdents64(r0, &(0x7f0000000040)=""/41, 0x29)
getdents64(r0, &(0x7f0000002f40)=""/4098, 0x1002)

430.556545ms ago: executing program 0 (id=42):
mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x11c0, 0x10)
open(&(0x7f0000000000)='./file0\x00', 0x108242, 0x78e22799f4a46fa9)
pselect6(0x40, &(0x7f0000000600)={0x0, 0x6, 0xeb, 0x2, 0x10000, 0x3adb, 0x7, 0x4}, &(0x7f0000000640)={0x9, 0x5, 0x4b9, 0x13, 0x5, 0x0, 0x1c00000000000, 0x1}, 0x0, 0x0, 0x0)

402.282327ms ago: executing program 2 (id=44):
syz_mount_image$vfat(&(0x7f0000000540), &(0x7f0000000000)='./file1\x00', 0x1004808, &(0x7f00000001c0)={[{@utf8}, {@iocharset={'iocharset', 0x3d, 'maccenteuro'}}, {@utf8}, {@fat=@codepage={'codepage', 0x3d, '1250'}}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@rodir}, {@uni_xlateno}, {@uni_xlate}, {@shortname_win95}, {@utf8no}, {@shortname_lower}, {@rodir}, {@uni_xlate}, {@uni_xlateno}, {@shortname_winnt}]}, 0x21, 0x2b0, &(0x7f0000000580)="$eJzs3ctqJFUYB/B/9S0dFboXrkSwQBeuwsw8wQSJMJiV0gvdaHAyIOkwkEiDF4yzmr3gynfwHXwAN76BC5eCO7MQS9KXpKe7chlpE8n8fpv+us731Xeq6nQCgT755PX9vYePDx89+frXdLtFGvdzP8dF+mlk5tsAALfJcVXlj2ristxWOkmq3vRd4xqmBwD8B46rqnnV3/8AwO3wwYcfvbe5vb31fll2k/2no0GxluTpaDAZ33yUzzLMbu6kl7+S6tQkfuXB9lZaZTn7Y8BoPYNk/+Ofp+83f0/G9XfTS3+xvjPNKsfy1v7RaHDS+eS1nZeKZLMqJin30surSdXO9CSTl3cfbG/dK5frM+jk7Td/mM7/791spJdfPs3jDPNwfIqz+m/uluU71fd/fjVu1B4kxdFosDbOO1M1r+WBAAAAAAAAAAAAAAAAAAAAAADwQtgoT/Xn98+Z7QbY3qgfP3d/oOkOP0dz++vcKctyto3PaNDOpL6V11pp3dyVAwAAAAAAAAAAAAAAAAAAwP/H4Rdf7u0Mh7sHzwQ/VSfB+oU5i0Fr7sjsa/31yZ9fesK9H5MrNX3uIM3p1IbFUotiNrSCXmvPk7xe1zSN8+5ha5jJ5L+7SovmM0/wjVVd4IXBbHXt7RS5JLlbv0jm5jxbhgeHRd2CbI2Hls5c1dy65rnT6Kzo2jsv/9vy9dob1Zn7qC5WdU+e5NyR9oo/KQuKlf7cAQAAAAAAAAAAAAAAAAAAlp196Te/LQ0+uZEpAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMC1O/v//6dB+otHFoOjafH4SGNnWFyQvHZwWNO2f82XCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwC33TwAAAP//svhQ2Q==")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='.\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4842, 0x1ff)
getdents64(r0, &(0x7f0000000200)=""/179, 0xb3)

349.638868ms ago: executing program 0 (id=52):
syz_mount_image$hfsplus(&(0x7f0000000600), &(0x7f0000000640)='./file2\x00', 0x0, &(0x7f0000000d80)={[{@gid}, {@barrier}, {@creator={'creator', 0x3d, "7f52c56f"}}, {@gid}, {@type={'type', 0x3d, "e481e91c"}}, {@gid}, {@nls={'nls', 0x3d, 'cp1255'}}, {@nobarrier}]}, 0xfe, 0x5f3, &(0x7f0000020940)="$eJzs3U9vHGcdB/DvbGLHG6R0kyZNQUhY5QBqROI/kQkSElAKslCFKnHp1Uqc2somjewtcnuAgDi3b6EczJkDJxSkHDjzFox6RMDZN6OZnVlvHNe1E+Ndp5+PNPs8M8/MM7/np9knM2NFG+Ara/G9TDxpJ4vX3tko17c257tbm/P3m3qSc0layVSSotz8lySfJ4/SX/L1pmGofEbx6eLtlcefXO2vTdVLtX9x0HGHM4il04+1Ko+rv7kX7m93hNNJLtUljNxO45/7Nr/g9xIAGGdFcma/7Z3kfH2zXj4H9O+K+/fYabadRo9GHQAAAACcgFe2s52NXBh1HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCa1L//X9RLq6lPp2h+/3+y3pa6fqo9GXUAAAAAAAAAAHAMvrWd7WzkQrO+U1R/83+jWrlcfX4tH2Y9y1nL9WxkKb30spbZJJ2hjiY3lnq9tdlDHDm375FzJzNeAAAAAAAAAHhJ/T6Lu3//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAcVAkZ/pFtVxu6p20ziaZSjJZ7vcoedzUT7Mnow4AAAAATsAr29nORi406ztF9cz/WvXcP5UP8yC9rKaXbpZzp3oX0H/qb21tzne3Nufvl8uz/f7kP0cKo+ox/XcP+595ptrjyuCIxfw8v8q1TOfdrGU1v85SelnOdN6uaksp0qnfXnSaOPeP98dPrb37ZbG+XkXSzt2sVrFdT7tuaVVjqPY5+Iy/K7NT/Kh2yBzdqctyRL+oy/HQqcY+McjITJ37MhsXD87EEa+TvWeaTWvwDury8eX8XFM5X5dlrt8e55xPzA1dfa8dnIlkZu7fD1e6D+6t3F2/Nj5Dek57r4n5oUxcPXImdnZ2fnviQzgmk3U2+rPo0WbLN6pjL2Q1v8wHuZPl3MpMbmUhNzOfhfwgC0N5vXKI71rraPPbt79bVyaS/Kwux0OZ14tDeR2e6TpV2/CW/w6Ou3T8/wqc/UZdKS/Wt8ZuRrq4Z25urpdXn87E2T2H/nGn/FzvPri3trL08JDn+05dlhn46fNlYm8cx6S8Xi4Nun/66ijbXt23bbZquzxoaz3TdmXQ9mXf1Mn6Hu7Znuaqtqv7ts1Xba8PtQ3f5dzOB+kO7kIAGGPn3zw/2f5X+x/tz9p/aK+035l669ytc9+czMTfz/71zJ9bf2r9sHgzn+U3u8//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA81v/6ON7S93u8pqKyugrU0kOu3Pzu0+jjvklreyZKCZHMDkB/1c3evcf3lj/6OPvrd5fen/5/eUHN2cX5m7enFn4/q0bd1e7yzP9z1GHCQAco92b/lFHAgAAAAAAAAAAAAAAfJGT+O/Eox4jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwclt8LxNPUmR25vpMub61Od8tl6a+u+dUkqKs/C3J58mj9Jd0hrorvug8xaeLt1cef3J1t6+pZv/ioOMO56lYWntietH+5l64v90RTie5VJcwcv8LAAD//1dWAHo=")
r0 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50)
getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8)

349.239101ms ago: executing program 1 (id=53):
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000580)={[{@max_batch_time={'max_batch_time', 0x3d, 0x4}}, {@max_batch_time={'max_batch_time', 0x3d, 0x2}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@errors_remount}, {@nombcache}]}, 0x1, 0x437, &(0x7f0000000900)="$eJzs289PHFUcAPDv7EKR/hBs6o/Sqmg1En9AobX24EWjiQdNTPRQjwi0wW6LKZjYhigaU4+miXfj0cS/wJNejHoy8ap306QxXFo9rZndGdhddrdAF7a6n08y8N7MW9777szbfW8eE0DPGk1/JBH7I+L3iBiqZusLjFZ/3Vpdnvl7dXkmiXL5rb+SSrmbq8szedH8dfvyTF9E4bMkjjSpd/HylfPTpdLcpSw/sXTh/YnFy1eem78wfW7u3NzFqdOnT56YfOHU1PMdiTON6+bIRwtHD7/2zrU3Zs5ce/fnb5M8/oY4OmS03cEny+UOV9ddB2rSSV8XG8KWFKvdNPor/X8oirF+8obi1U+72jhgR5XL5fIDrQ+vlIH/sSS63QKgO/Iv+nT+m2+7NPS4K9x4qToBSuO+lW3VI31RyMr0N8xvO2k0Is6s/PNVusXO3IcAAKjzfTr+ebbZ+K8QtfeF7s3WUIYj4r6IOBgRpyLiUETcH1Ep+2BEPNSskqR1/Y2LJBvHP4Xr2w5uE9Lx34vZ2lb9+C8f/cVwMcsdqMTfn5ydL80dz96TsegfSPOTber44ZXfvmh1rHb8l25p/flYMGvH9b6B+tfMTi9N30nMtW58EjHS1yz+ZG0lID19hyNiZJt1zD/9zdFWx24ffxsdWGcqfx3xVPX8r0RD/Lmk/frkxD1Rmjs+kV8VG/3y69U3W9V/R/F3QHr+9za9/tfiH05q12sXt17H1T8+bzmn2e71vyd5u27fh9NLS5cmI/Ykr1cbXbt/qqHc1Hr5NP6xY837/8FYfyeORER6ET8cEY9ExKNZ2x+LiMcj4lib+H96+Yn3thf/QJu/2hlp/LNbOv/riT3RuKd5onj+x+/qKh3ebPyRnf+TldRYtmczn3+badf2rmYAAAD47ylExP5ICuNr6UJhfLz6P/yHYm+htLC49MzZhQ8uzlafERiO/kJ+p2uo5n7oZDatz/NTDfkT2X3jL4uDlfz4zEJpttvBQ4/b16L/p/4sdrt1wI7zvBb0Lv0fepf+D71L/4fe1aT/D3ajHcDua/b9/3EX2gHsvob+b9kPeoj5P/Qu/R96l/4PPWlxMG7/kLyExIZEFO6KZkjsUKLbn0wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACd8W8AAAD//zpS5t0=")
r0 = open(&(0x7f00000000c0)='./file2\x00', 0x146142, 0x0)
pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x140000}], 0x14, 0x7800, 0x0, 0x3)

199.39709ms ago: executing program 2 (id=54):
syz_mount_image$hfs(&(0x7f0000000740), &(0x7f0000000500)='./file0\x00', 0x1000000, &(0x7f0000000780)=ANY=[], 0x11, 0x325, &(0x7f0000001980)="$eJzs3U1rE0EYB/D/TJImaWtd24ogglJb0Iv4CiJCRXKT3j2J2qRQDBVsBfXSVrwpfgBvHvwKfgjBF7x50pMnjx56kZF5dnY72Ww2De1mW/3/oGEzO7PzDLO7M7PQLIjov3Wz8f3dpZ/2TwEllABcAzSAGlAGcBTHao9X1pbX2q2RrAOVpARmfhsBQHXlWVxppRW15aQuJ7Dfyhj30ygfxpgbP4oOggonV38KDVTddSj7a0OOKy8bwMmiYxg2v4PVFrbwBBMFhkNERPuAG/+1GybGJUlBa2DOH/YP4Pj/MS1xa/hx5OlyuyvJZBaQ8f/b6ES08jLK9vth2RWt95rhEs7u19EqcSfBVBLfZd2oExNMr5Z0EouuLy2XcW5xE02N55gXVT/btHw2w1M30ifamZS1aYbeR6tgYTRsjcwok6KQlpbbLQl63vHyTA1W4+68tKF+UF/UHRXgDZrx/K9slO0m6akg0VO6YuM/3/uoY1LK5oJb9s/D6I4sR6SS464Gp08ra+krEv+Y0QOCjTiCrDil7klXSnW07kKfUlPofBghpYL4W49S0x2lSl6tvU76HEVNVK/VbTWDX3iPhjf/1za+OXhXZtatXklOd2YsPmw3O3vWU5acQXLkOLQZb56KI3CqgzeOMODTsle4j6uYWH367EGp3W49shv3EhtjLq9LqbwAuvLs/UYV3btKyCiFje0Uefi4bsxOKzV5Nufsnh7Q3j/iFHvHS8tsr7I4Rfc5cjRQ59+nuWyc+BOGn9i17lqVY+2Nz8g6IYe2MeKfEnajPuBxjImv7jBl4font2vvbky0f60q29fe0FEvMhoqgJ13qXD9JwO+m9XJVNV+BBnz9OxFZrQ2qIdz7HgF1zkVnJTP0YFWcGO9V3BeGy5urxm711ynzwCzXqKCq3E99bCBi/MfoRr4irt8/k9EREREREREREREREREREREREREdNDs5F8F9C7/RaToNhIRERERERERERERERERERERERERERERHXSDvP83fmmN/EZ84i0t8v7fwJZS7l0k0S90v70yeyvc4vt/ifaVvwEAAP//U+lukA==")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0)

198.790748ms ago: executing program 0 (id=55):
mount(0x0, &(0x7f0000000240)='.\x00', &(0x7f0000000080)='nfs\x00', 0x0, &(0x7f00000001c0)='\x05\x00\x00\x00\x04\xb0\xfe\x98\xab\xc9\xa2IV\xb6-\xd9z\x81\x91\x8aP}I\xc6\x0e\xd9\r\x11\xa0\xd7\xd7\xb6\x9bz\x99\xaf\xfd\x87fN\xad\x90U\xb4A\xdf\xabB\xbba\x7f\xb8\x96\x1a\xe7\xc1\xab\x16\xc77<r\xe9\x9cD\xb0\xce\xe1\xc5\x85=\\!\xbbQ\xde\xc3\xe3\x7f\xcf\x1f\x17G\xa6\x13\xae\x92 \x1c\xbf\xfa\xe8e\x8cD\"\xa3wA\xf6`>\x8b')

132.215213ms ago: executing program 1 (id=56):
mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb)
fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000000)='=:,\n-&\xf5\xcc\xd7\x06f\xcdY\xb9\xc7\x9d\xb2a\r\xd7\xef\xc5\x112i\x88\n\x13.\xd6\xfa\xd5?\xc7\xfd&\x8d*\xbb\xa7&,\xe9\xa3\'\x91>C\x1b\x15\x87\xeb\xfe\x1c\x9d\\C\xfeI\'\xae\x8fKHq\x89\x83\xbb\x9dC\xd6Hy\x04\xa4\xb6\x88\xdb\xa1b\xae\xa7\x87\xcc\xc7\xa4\xdc\n:///\x00\x00\x00\x85^\x00\x0f\bu\x01\xab\x8c\x95?\x90\x8d_r\xe7\r\'-06,\xff\x84x\'+\xd5\xd4?[e\x19\xa3\\J\xe9\x8a\xb9\xe4r\x93\xb3\xd3J \x06\x03\xae', 0xfeffffff00000000)
mkdir(0x0, 0x190)
mount$bpf(0x200000000000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x6000, 0x0)

51.638433ms ago: executing program 2 (id=57):
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000680)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x30, 0x9d, @in={0x1b, 0x0, @local}, @ib={0x1b, 0xffff, 0x0, {"00000000009de402e395c51a00000009"}, 0x80000, 0x0, 0x3ff}}}, 0x118)

51.424087ms ago: executing program 0 (id=58):
syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000280)='./bus\x00', 0x4000, &(0x7f0000000300)=ANY=[], 0x3, 0x2cb, &(0x7f0000000ac0)="$eJzs3U9LW1kYx/GfJmNiHE0Ww8AMDHOY2cxsgpN5ATNhUBgmMMUaabsoXOtNG3KbyL3BEik1m9JtX4d02V2h7RtwU7rpvjspFLpxUXqL9yaaaJLGkD9avx+Q8yTPeXKO5ihPLiTuX3t8t1Tw0gWrqum40bRU14GUOowaphrjdBDPqFVdv899ePPT1es3/svmcksrxixnV//MGGMWfn5+7/6TX15W59aeLjyLaS91c/995u3ezN4P+59W7xQ9U/RMuVI1llmvVKrWumObjaJXShtzxbEtzzbFsme7bfmCU9ncrBmrvDGf2HRtzzNWuWZKds1UK6bq1ox12yqWTTqdNvMJXW7RPubkd1dWrGzXtB8Z6o4wcrOd7nTdbL1zMr87hj0BAIBzpnf/H/b63fv/3Fo4nqX///7L/b9E/z8i9bZbXfr/b8e4IYyc62atROP3tx39PwAAAAAAAAAAAAAAAAAAAAAAF8GB7yd9308ejo27gtsxSXFJfiN/VNDP28pxYbQ+/37LV9fnP/TXhLaLIWt5415cch5t5bfy4RjmswUV5cjWopL6GJyHhjBe/je3tGgCKb1wdhr1O1v5iGLN+qZUp/qpqBQ+QHv9N0q0rp9RUt91Xj9jOtXP6LdfW+rTSurVLVXkaCM418f1D/4w5p//cyfqZ4N5AAAAAAB8DdLmyKnX70E+mBDX6XxY33J9wPf9nV7XB068vo7qR64lAgAAAAAwFl5tu2Q5ju0OEMQkDVYuDbxor8D3paE+4EBBRJNcvVvwt6RzsI1xBXE1z5gZpPydznRE/T7mRCVN/MdyhmDSf5kAAAAADJtX2z7+Bz/9ev1wRLsBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBy6vfzwJrzT6WaiZ6f9nckMvZvEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADhHPgcAAP//ps0YVA==")
ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0)
fcntl$notify(r0, 0x402, 0x40000029)
ioctl$FAT_IOCTL_SET_ATTRIBUTES(r0, 0x40047211, &(0x7f0000000000)=0x10)

0s ago: executing program 1 (id=59):
syz_mount_image$hfs(&(0x7f0000000080), &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x84, &(0x7f0000000000)=ANY=[], 0x8b, 0x2e3, &(0x7f0000000800)="$eJzs3UFPE00cx/Hf7Ja2PPDw7CMYE+PBoERPRvBivDQxxNfgRSPSmhAaiIiJcrHxbHwB3rn4AnwRxoMx8YwnT74AbmtmO2Wn7W5LQbog309S2t2d2fnP7rY7/6XNCsC5dX95b/fOT/swUqhQ0j0psIuuqiTpoi5VX25sr203G/VBKwqlqpKHkZKapq/M6kYjq6qtl9RwIjtV0rQ/DycjjuP4R9FBoEhV9xxmLQykint3hn7h06zSMz3RM90KpdYY4zmNzL729UozRccBACiWaZ/fA3een3bj9yCQFtxp3z//f/+34HiP54b2iw6hYN75P8myYmP373/JojTfM5p05TtZ4qjt2LFYWe0jq2uAabqzyv5kMYklmHy21mzcWt1s1gO9VS1h/LxwTlJNdZezZkXbv+r5jHndyv7E3rDSuaaSPkzYPiyl8ddqXpHZrEaPurUPw3w2X81jE+mD6gfjv1Js/D67PfVgIo3/dt7qNp8/ss9Ru1ROL/+3u6F0uXvDDuxlmJeRyG2pOFT3BYKoO85yZq2yemq1e7eY15Jbz2xmraUhteZsrY9erfRozq950sx789DM65c+adkb/wd2ay+o/52ZvZKkpDsyBvanlJSM/FmtK5klg9H7ghGl2/idnuquZl683llfaTYbW+N+YWMYe6Pn80Wk3jmdg+C0RHi0F/Yz1p+jqLFVGk/r5WNvuqrbKXYw01+msrO+UvELt3vaOSH2rrDztj5E650LeEMjHOOnEgqT7vT8Mm/Ef2L+YvbDw7TzP5evTNlRXZL02D/RgHF6PGzY5mVAixm5QXqp/h9vTcZdn8/PgKYyM7iWDpdzJXWv3ZSuezP3diuDcq5IF3SQDZ99Zlnf9ITr/wAAAAAAAAAAAAAAAAAAAGdN37f/v0y3F/zB30t4zfE9cgAAAAAAAAAAAAAAAAAAAAAAjiD//r9VneD9f9PfAUyOcP/f3ht7AjiW3wEAAP//zmlk6Q==")
syz_mount_image$vfat(&(0x7f0000000180), &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, 0x1, 0x0, &(0x7f00000007c0))
chdir(&(0x7f0000000140)='./bus\x00')
r0 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0)
getdents64(r0, 0x0, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:4875' (ED25519) to the list of known hosts.
syzkaller login: [   48.713966][ T5564] cgroup: Unknown subsys name 'net'
[   48.793283][ T5564] cgroup: Unknown subsys name 'cpuset'
[   48.797233][ T5564] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.059467][ T5564] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   58.969906][ T5659] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   60.307210][ T5669] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   60.313166][ T5669] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   60.321308][ T5669] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   60.325179][ T5669] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   60.328153][ T5669] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   60.331027][ T5669] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   60.339905][ T5669] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   60.342778][ T5669] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   60.346843][ T5669] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   60.352348][   T54] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   60.366754][ T4999] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   60.382780][ T5669] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   60.386790][ T5669] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   60.389500][ T5669] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   60.394775][ T5669] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   60.962255][ T5667] bridge0: port 1(bridge_slave_0) entered blocking state
[   60.965444][ T5667] bridge0: port 1(bridge_slave_0) entered disabled state
[   60.968261][ T5667] bridge_slave_0: entered allmulticast mode
[   60.971555][ T5667] bridge_slave_0: entered promiscuous mode
[   60.984705][ T5667] bridge0: port 2(bridge_slave_1) entered blocking state
[   60.987166][ T5667] bridge0: port 2(bridge_slave_1) entered disabled state
[   60.989557][ T5667] bridge_slave_1: entered allmulticast mode
[   60.992397][ T5667] bridge_slave_1: entered promiscuous mode
[   61.026387][ T5666] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.029531][ T5666] bridge0: port 1(bridge_slave_0) entered disabled state
[   61.034258][ T5666] bridge_slave_0: entered allmulticast mode
[   61.037541][ T5666] bridge_slave_0: entered promiscuous mode
[   61.043194][ T5666] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.046125][ T5666] bridge0: port 2(bridge_slave_1) entered disabled state
[   61.049093][ T5666] bridge_slave_1: entered allmulticast mode
[   61.053887][ T5666] bridge_slave_1: entered promiscuous mode
[   61.084005][ T5667] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   61.090802][ T5667] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   61.121416][ T5666] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   61.138872][ T5666] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   61.177422][ T5667] team0: Port device team_slave_0 added
[   61.181276][ T5667] team0: Port device team_slave_1 added
[   61.190312][ T5666] team0: Port device team_slave_0 added
[   61.219764][ T5666] team0: Port device team_slave_1 added
[   61.222727][ T5667] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.225374][ T5667] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   61.234685][ T5667] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.257733][ T5667] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.262132][ T5667] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   61.271848][ T5667] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.275847][ T5673] bridge0: port 1(bridge_slave_0) entered blocking state
[   61.278588][ T5673] bridge0: port 1(bridge_slave_0) entered disabled state
[   61.281651][ T5673] bridge_slave_0: entered allmulticast mode
[   61.284651][ T5673] bridge_slave_0: entered promiscuous mode
[   61.305454][ T5673] bridge0: port 2(bridge_slave_1) entered blocking state
[   61.308718][ T5673] bridge0: port 2(bridge_slave_1) entered disabled state
[   61.311119][ T5673] bridge_slave_1: entered allmulticast mode
[   61.314065][ T5673] bridge_slave_1: entered promiscuous mode
[   61.317761][ T5666] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.320542][ T5666] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   61.329669][ T5666] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.335445][ T5666] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.337844][ T5666] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   61.347456][ T5666] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.388868][ T5673] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   61.404576][ T5673] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   61.419337][ T5667] hsr_slave_0: entered promiscuous mode
[   61.421868][ T5667] hsr_slave_1: entered promiscuous mode
[   61.447257][ T5666] hsr_slave_0: entered promiscuous mode
[   61.450790][ T5666] hsr_slave_1: entered promiscuous mode
[   61.454411][ T5666] debugfs: 'hsr0' already exists in 'hsr'
[   61.456458][ T5666] Cannot create hsr debugfs directory
[   61.482480][ T5673] team0: Port device team_slave_0 added
[   61.505184][ T5673] team0: Port device team_slave_1 added
[   61.563934][ T5673] batman_adv: batadv0: Adding interface: batadv_slave_0
[   61.566437][ T5673] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   61.576009][ T5673] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   61.581922][ T5673] batman_adv: batadv0: Adding interface: batadv_slave_1
[   61.584486][ T5673] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   61.593270][ T5673] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   61.706540][ T5673] hsr_slave_0: entered promiscuous mode
[   61.708928][ T5673] hsr_slave_1: entered promiscuous mode
[   61.711396][ T5673] debugfs: 'hsr0' already exists in 'hsr'
[   61.713240][ T5673] Cannot create hsr debugfs directory
[   61.822451][ T5667] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   61.831239][ T5667] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   61.858973][ T5667] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   61.865331][ T5667] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   61.868795][ T5667] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   61.875292][ T5667] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   61.892638][ T5667] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   61.897246][ T5667] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   61.945588][ T5666] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   61.953831][ T5666] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   61.962816][ T5666] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   61.967526][ T5666] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   61.977211][ T5666] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   61.982489][ T5666] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   61.985412][ T5666] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   61.992564][ T5666] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   62.049121][ T5673] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   62.053690][ T5673] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   62.056821][ T5673] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   62.061378][ T5673] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   62.072082][ T5673] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   62.077267][ T5673] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   62.083965][ T5673] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   62.089120][ T5673] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   62.156626][ T5667] 8021q: adding VLAN 0 to HW filter on device bond0
[   62.192321][ T5667] 8021q: adding VLAN 0 to HW filter on device team0
[   62.205830][ T5666] 8021q: adding VLAN 0 to HW filter on device bond0
[   62.209271][ T3326] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.211949][ T3326] bridge0: port 1(bridge_slave_0) entered forwarding state
[   62.230441][ T3326] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.232694][ T3326] bridge0: port 2(bridge_slave_1) entered forwarding state
[   62.264160][ T5666] 8021q: adding VLAN 0 to HW filter on device team0
[   62.272058][ T5673] 8021q: adding VLAN 0 to HW filter on device bond0
[   62.283813][ T3326] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.286029][ T3326] bridge0: port 1(bridge_slave_0) entered forwarding state
[   62.305815][ T3326] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.308110][ T3326] bridge0: port 2(bridge_slave_1) entered forwarding state
[   62.345442][ T5673] 8021q: adding VLAN 0 to HW filter on device team0
[   62.365511][ T3326] bridge0: port 1(bridge_slave_0) entered blocking state
[   62.368004][ T3326] bridge0: port 1(bridge_slave_0) entered forwarding state
[   62.382819][ T3326] bridge0: port 2(bridge_slave_1) entered blocking state
[   62.385037][ T3326] bridge0: port 2(bridge_slave_1) entered forwarding state
[   62.411407][   T54] Bluetooth: hci2: command tx timeout
[   62.411805][ T5669] Bluetooth: hci0: command tx timeout
[   62.420364][ T5669] Bluetooth: hci1: command tx timeout
[   62.595980][ T5667] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.644151][ T5667] veth0_vlan: entered promiscuous mode
[   62.656966][ T5667] veth1_vlan: entered promiscuous mode
[   62.683466][ T5667] veth0_macvtap: entered promiscuous mode
[   62.705169][ T5667] veth1_macvtap: entered promiscuous mode
[   62.722646][ T5667] batman_adv: batadv0: Interface activated: batadv_slave_0
[   62.728586][ T5667] batman_adv: batadv0: Interface activated: batadv_slave_1
[   62.745185][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   62.762452][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   62.770600][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   62.776834][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   62.805910][ T5666] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.814588][ T5673] 8021q: adding VLAN 0 to HW filter on device batadv0
[   62.918615][ T5666] veth0_vlan: entered promiscuous mode
[   62.927965][   T82] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.935172][   T82] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.958064][ T5666] veth1_vlan: entered promiscuous mode
[   62.969010][   T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   62.974026][   T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   62.976309][ T5673] veth0_vlan: entered promiscuous mode
[   62.993812][ T5673] veth1_vlan: entered promiscuous mode
[   63.030579][ T5666] veth0_macvtap: entered promiscuous mode
[   63.049132][ T5666] veth1_macvtap: entered promiscuous mode
[   63.049186][ T5777] loop1: detected capacity change from 0 to 16
[   63.065654][ T5777] erofs (device loop1): mounted with root inode @ nid 36.
[   63.073557][ T5777] syz.1.45: attempt to access beyond end of device
[   63.073557][ T5777] loop1: rw=8388608, sector=34359736320, nr_sectors = 8 limit=16
[   63.076162][ T5673] veth0_macvtap: entered promiscuous mode
[   63.098120][ T5666] batman_adv: batadv0: Interface activated: batadv_slave_0
[   63.102479][ T5673] veth1_macvtap: entered promiscuous mode
[   63.114315][ T5666] batman_adv: batadv0: Interface activated: batadv_slave_1
[   63.147773][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   63.162587][ T5673] batman_adv: batadv0: Interface activated: batadv_slave_0
[   63.164932][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   63.168516][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   63.176181][ T5673] batman_adv: batadv0: Interface activated: batadv_slave_1
[   63.178717][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   63.212553][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   63.215796][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   63.227937][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   63.239139][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   63.336583][ T5785] loop1: detected capacity change from 0 to 256
[   63.344773][   T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   63.345688][ T5785] FAT-fs (loop1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[   63.347701][   T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   63.393593][ T3326] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   63.399597][ T3326] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   63.440863][ T3326] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   63.447357][ T3326] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   63.497366][ T3326] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   63.501129][ T3326] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   63.614423][ T5793] loop2: detected capacity change from 0 to 256
[   63.627740][ T5795] loop0: detected capacity change from 0 to 1024
[   63.642639][ T5795] hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended.  mounting read-only.
[   63.660086][ T5797] loop1: detected capacity change from 0 to 512
[   63.669476][ T5797] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[   63.672411][   T34] audit: type=1800 audit(1785534394.078:2): pid=5793 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.44" name="file1" dev="loop2" ino=1048615 res=0 errno=0
[   63.679676][ T5797] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode
[   63.714618][ T5797] EXT4-fs warning (device loop1): ext4_expand_extra_isize_ea:2860: Unable to expand inode 15. Delete some EAs or run e2fsck.
[   63.722166][ T5797] EXT4-fs (loop1): 1 truncate cleaned up
[   63.726066][ T5797] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   63.737723][   T34] audit: type=1800 audit(1785534394.148:3): pid=5797 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.53" name="file2" dev="loop1" ino=16 res=0 errno=0
[   63.799602][ T5801] loop2: detected capacity change from 0 to 64
[   63.823693][ T5801] hfs: cannot create new inode: file count exceeds limit
[   63.829517][ T5667] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   63.964832][ T5807] loop1: detected capacity change from 0 to 64
[   63.997420][ T5809] loop0: detected capacity change from 0 to 128
[   64.024254][ T5809] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1)
[   64.047124][   T83] ------------[ cut here ]------------
[   64.049720][   T83] kernel BUG at fs/hfs/inode.c:476!
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[   64.061004][   T83] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
[   64.063603][   T83] CPU: 1 UID: 0 PID: 83 Comm: kworker/u10:5 Not tainted syzkaller #0 PREEMPT(full) 
[   64.066669][   T83] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   64.069604][   T83] Workqueue: writeback wb_workfn (flush-7:1)
[   64.071887][   T83] RIP: 0010:hfs_write_inode+0x9c7/0xa00
[   64.073465][   T83] Code: 40 31 ff e8 fb d6 0f ff 81 e3 00 00 00 40 75 1c e8 ae d2 0f ff 49 bc f8 f8 f8 f8 f8 f8 f8 f8 e9 48 f7 ff ff e8 9a d2 0f ff 90 <0f> 0b e8 92 d2 0f ff e8 7d 87 7b fe eb dd 44 89 f1 80 e1 07 80 c1
[   64.079631][   T83] RSP: 0000:ffffc9000274f180 EFLAGS: 00010293
[   64.081604][   T83] RAX: ffffffff82b73236 RBX: ffff8881bad69f00 RCX: ffff888169365a00
[   64.083904][   T83] RDX: 0000000000000000 RSI: ffffffff8edd03f0 RDI: 0000000000000000
[   64.086228][   T83] RBP: ffffc9000274f318 R08: ffff888169365a00 R09: 0000000000000003
[   64.088966][   T83] R10: 0000000000000004 R11: 0000000000000000 R12: f8f8f8f8f8f8f8f8
[   64.091798][   T83] R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920004e9e34
[   64.094937][   T83] FS:  0000000000000000(0000) GS:ffff8882a8f4b000(0000) knlGS:0000000000000000
[   64.098209][   T83] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   64.102648][   T83] CR2: 0000001b2ef22ff8 CR3: 000000000e946000 CR4: 00000000000006f0
[   64.105694][   T83] Call Trace:
[   64.107157][   T83]  <TASK>
[   64.108372][   T83]  ? __pfx_hfs_write_inode+0x10/0x10
[   64.110621][   T83]  ? do_raw_spin_unlock+0x4d/0x210
[   64.113268][   T83]  __writeback_single_inode+0x69d/0x1220
[   64.115650][   T83]  writeback_sb_inodes+0x9de/0x1b00
[   64.117746][   T83]  ? __pfx_writeback_sb_inodes+0x10/0x10
[   64.119844][   T83]  ? rcu_is_watching+0x15/0xb0
[   64.122125][   T83]  ? queue_io+0x2d3/0x470
[   64.123770][   T83]  wb_writeback+0x41c/0xad0
[   64.125577][   T83]  ? queue_io+0x2a1/0x470
[   64.127222][   T83]  ? __pfx_wb_writeback+0x10/0x10
[   64.129180][   T83]  ? do_raw_spin_lock+0x12b/0x2f0
[   64.131275][   T83]  wb_workfn+0x431/0x10f0
[   64.133012][   T83]  ? __pfx_wb_workfn+0x10/0x10
[   64.134960][   T83]  ? rcu_is_watching+0x15/0xb0
[   64.136817][   T83]  ? trace_hrtimer_start+0x82/0x200
[   64.138818][   T83]  ? do_raw_spin_lock+0x12b/0x2f0
[   64.140942][   T83]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   64.143059][   T83]  ? process_scheduled_works+0xa20/0x14e0
[   64.145457][   T83]  ? process_scheduled_works+0xa20/0x14e0
[   64.147673][   T83]  ? rcu_is_watching+0x15/0xb0
[   64.149892][   T83]  ? process_scheduled_works+0xa20/0x14e0
[   64.151988][   T83]  process_scheduled_works+0xa8e/0x14e0
[   64.154168][   T83]  ? __pfx_process_scheduled_works+0x10/0x10
[   64.156520][   T83]  ? assign_work+0x3cf/0x5d0
[   64.158313][   T83]  worker_thread+0xa47/0xfb0
[   64.160056][   T83]  kthread+0x388/0x470
[   64.161581][   T83]  ? __pfx_worker_thread+0x10/0x10
[   64.163534][   T83]  ? __pfx_kthread+0x10/0x10
[   64.165281][   T83]  ret_from_fork+0x514/0xb70
[   64.167275][   T83]  ? __pfx_ret_from_fork+0x10/0x10
[   64.169180][   T83]  ? __switch_to+0xc89/0x1420
[   64.171094][   T83]  ? __pfx_kthread+0x10/0x10
[   64.172839][   T83]  ret_from_fork_asm+0x1a/0x30
[   64.174758][   T83]  </TASK>
[   64.176041][   T83] Modules linked in:
[   64.178264][   T83] ---[ end trace 0000000000000000 ]---
[   64.278322][   T83] RIP: 0010:hfs_write_inode+0x9c7/0xa00
[   64.280984][   T83] Code: 40 31 ff e8 fb d6 0f ff 81 e3 00 00 00 40 75 1c e8 ae d2 0f ff 49 bc f8 f8 f8 f8 f8 f8 f8 f8 e9 48 f7 ff ff e8 9a d2 0f ff 90 <0f> 0b e8 92 d2 0f ff e8 7d 87 7b fe eb dd 44 89 f1 80 e1 07 80 c1
[   64.288459][   T83] RSP: 0000:ffffc9000274f180 EFLAGS: 00010293
[   64.291101][   T83] RAX: ffffffff82b73236 RBX: ffff8881bad69f00 RCX: ffff888169365a00
[   64.294275][   T83] RDX: 0000000000000000 RSI: ffffffff8edd03f0 RDI: 0000000000000000
[   64.297567][   T83] RBP: ffffc9000274f318 R08: ffff888169365a00 R09: 0000000000000003
[   64.302505][   T83] R10: 0000000000000004 R11: 0000000000000000 R12: f8f8f8f8f8f8f8f8
[   64.305727][   T83] R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920004e9e34
[   64.309894][   T83] FS:  0000000000000000(0000) GS:ffff8882a8f4b000(0000) knlGS:0000000000000000
[   64.313988][   T83] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   64.316685][   T83] CR2: 0000001b2f320ff8 CR3: 00000001122ca000 CR4: 00000000000006f0
[   64.322296][   T83] Kernel panic - not syncing: Fatal exception
[   64.329344][   T83] Kernel Offset: disabled
[   64.331029][   T83] Rebooting in 86400 seconds..

VM DIAGNOSIS:
21:46:34  Registers:
info registers vcpu 0

CPU#0
RAX=000000006e80ccb0 RBX=ffff888174d05f00 RCX=000000009905ee9e RDX=00000000a2a7f5d4
RSI=0000000000000001 RDI=0000000022abd31b RBP=000000004a2a7f5d RSP=ffffc9000275f988
R8 =00000000dc4e0f8a R9 =0000000015d942a7 R10=000000000000000b R11=ffffffff8eb59ce0
R12=dffffc0000000000 R13=0000000000002000 R14=ffffc9000275fa20 R15=1ffff920004ebf40
RIP=ffffffff8510a116 RFL=00000a93 [-OS-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f6454d14c80 ffffffff 00c00000
GS =0000 ffff88818d94b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f42e57ed158 CR3=0000000170568000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=00ff000000000000 ff00000000000000 XMM05=0000000000002f38 0000000000003230
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=ffffffffffff0000 ffffffffffff0000 XMM09=6c6c696b66722f38 7968702f31313230
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff824063d3 RBX=0000000000000001 RCX=ffff88816e2f5a00 RDX=0000000000000000
RSI=000000000001c7fe RDI=0000000400000000 RBP=ffffc90004377690 RSP=ffffc90004377310
R8 =ffffea000071ff87 R9 =1ffffd40000e3ff0 R10=dffffc0000000000 R11=fffff940000e3ff1
R12=dffffc0000000000 R13=00007f9f65e00000 R14=000000000001c7fe R15=00007f9f65df7000
RIP=ffffffff81c70506 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8882a8f4b000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=0000001b2ef22ff8 CR3=000000000e946000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 00007f9f67d5d560
XMM02=00007f9f671f25e8 00007f9f671f2618 XMM03=00007f9f671f2600 00007f9f671f25e0
XMM04=00007f9f67d5d020 00007f9f671f25c0 XMM05=00007f9f671f25d0 00007f9f671f2610
XMM06=00007f9f671f25f8 00007f9f671f25c8 XMM07=00007f9f671f2600 00007f9f671f25e0
XMM08=899aa54ff39ac0f3 f7ea72e000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
