00703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000015ad00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:01:55 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:55 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:55 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=ANY=[@ANYBLOB="75735c6f29e3698555e591898ba49b6e2300"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000100)='/dev/midi#\x00', 0x5, 0x2) getsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f00000001c0), 0x2) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:01:55 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000f801) 14:01:55 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:55 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001ad700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:01:55 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000096) 14:01:55 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$vcsa(&(0x7f0000000200)='/dev/vcsa#\x00', 0x3ff, 0x100) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_POOL(r1, 0xc058534b, &(0x7f0000000480)={0x3, 0x7, 0x8c, 0x6, 0x5, 0x8000}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) seccomp(0x0, 0x1, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x7, 0x2, 0x200, 0x8}]}) read$FUSE(r2, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f00000040c0), 0xbb) 14:01:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000012d000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:01:55 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488d") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:55 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000e1e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:01:55 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488d") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:55 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 458.268465] overlayfs: failed to resolve './file1': -2 14:01:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000001a000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:01:56 executing program 2: syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:56 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000a600) 14:01:56 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488d") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:56 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001c5) [ 459.586591] device bridge_slave_1 left promiscuous mode [ 459.592050] bridge0: port 2(bridge_slave_1) entered disabled state [ 459.599252] device bridge_slave_0 left promiscuous mode [ 459.604708] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.627218] team0 (unregistering): Port device team_slave_1 removed [ 459.635646] team0 (unregistering): Port device team_slave_0 removed [ 459.644826] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 459.656061] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 459.675123] bond0 (unregistering): Released all slaves 14:01:58 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000243900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:01:58 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:58 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d76") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:58 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20006001) 14:01:58 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="757375400000000000000000000000000000166ac43d16318c5d5e1004c0dc81a0f19c5de3aad8e8bf383400e7e9a6999ea772c64e2f7b8a6e58f32bfa272c485038b0b1ba5cc43181bf527513b0578d6b1737ebde6a1cd54489d1fef07921782b3c0864e74f3e55e4c93fe246cc1fc3cfa0b8c9749baff883c335191bce96f27131a175d28b5928833bff91301c71cc1759793c43e6ad58115108239d485d99142d3b510f6154270183af80"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f0000001000), 0x1000) accept$unix(r0, &(0x7f00000001c0), &(0x7f0000000100)=0x6e) 14:01:58 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001f5) 14:01:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000175600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 461.228147] __ntfs_error: 17 callbacks suppressed [ 461.228156] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 461.243626] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 461.252294] overlayfs: missing 'lowerdir' 14:01:59 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d76") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:59 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000144b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 461.380693] IPVS: ftp: loaded support on port[0] = 21 [ 461.431402] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 461.448129] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 461.475043] overlayfs: missing 'lowerdir' 14:01:59 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d76") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:59 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000014e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 461.572781] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 461.610336] overlayfs: unrecognized mount option "lowerdir" or missing value [ 461.625002] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:01:59 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,wor']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:01:59 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d7660") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 461.724781] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 461.761638] overlayfs: unrecognized mount option "wor" or missing value [ 461.797273] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 462.170187] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.176620] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.183411] device bridge_slave_0 entered promiscuous mode [ 462.206504] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.212906] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.220025] device bridge_slave_1 entered promiscuous mode [ 462.242216] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 462.264729] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 462.327821] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 462.352205] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 462.447235] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 462.454614] team0: Port device team_slave_0 added [ 462.475484] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 462.482751] team0: Port device team_slave_1 added [ 462.504540] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 462.527776] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 462.552440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 462.575998] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 462.774505] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.780927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 462.787585] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.793941] bridge0: port 1(bridge_slave_0) entered forwarding state [ 463.499635] 8021q: adding VLAN 0 to HW filter on device bond0 [ 463.570713] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 463.640007] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 463.646114] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 463.654105] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 463.723558] 8021q: adding VLAN 0 to HW filter on device team0 14:02:02 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000c201) 14:02:02 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000076900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:02 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=.']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:02 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d7660") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:02 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20001201) 14:02:02 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$admmidi(&(0x7f0000000200)='/dev/admmidi#\x00', 0x8, 0x41) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f00000003c0)=[0xee01, 0xee00, 0x0]) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='fuse\x00', 0x4000, &(0x7f0000000500)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x7}}, {@blksize={'blksize'}}, {@allow_other='allow_other'}, {@default_permissions='default_permissions'}, {@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x3f}}, {@blksize={'blksize', 0x3d, 0x800}}, {@default_permissions='default_permissions'}], [{@dont_appraise='dont_appraise'}, {@obj_type={'obj_type', 0x3d, 'fuse\x00'}}]}}) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r4, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r4, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r4, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r4, &(0x7f0000001000), 0x1000) [ 464.958684] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 464.985252] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 465.001037] overlayfs: workdir and upperdir must be separate subtrees 14:02:02 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./fi']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:02 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d7660") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:02 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000022cd00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:02 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000022aa00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 465.161910] overlayfs: failed to resolve './fi': -2 14:02:02 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:02 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d7660") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 465.325737] overlayfs: failed to resolve './file': -2 14:02:03 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000a5) 14:02:03 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000021cf00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:03 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488d") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:03 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:03 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002700) 14:02:05 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x40000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000013f300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:05 executing program 3 (fault-call:8 fault-nth:0): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:05 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000b601) 14:02:05 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:05 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000173) [ 468.101818] __ntfs_error: 6 callbacks suppressed [ 468.101827] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 468.124440] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 468.173975] FAULT_INJECTION: forcing a failure. [ 468.173975] name failslab, interval 1, probability 0, space 0, times 0 [ 468.192868] CPU: 0 PID: 25479 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 468.200178] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 468.209557] Call Trace: [ 468.212154] dump_stack+0x1c4/0x2b4 [ 468.215787] ? dump_stack_print_info.cold.2+0x52/0x52 [ 468.220980] ? usercopy_warn+0x110/0x110 [ 468.225084] should_fail.cold.4+0xa/0x17 [ 468.229151] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 468.234257] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 468.240053] ? pid_task+0x115/0x200 [ 468.243686] ? find_vpid+0xf0/0xf0 [ 468.247240] ? __f_unlock_pos+0x19/0x20 [ 468.251219] ? lock_downgrade+0x900/0x900 [ 468.255373] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 468.260914] ? proc_fail_nth_write+0x9e/0x210 [ 468.265404] ? proc_cwd_link+0x1d0/0x1d0 [ 468.269476] ? fs_reclaim_acquire+0x20/0x20 [ 468.273793] ? lock_downgrade+0x900/0x900 [ 468.277945] ? ___might_sleep+0x1ed/0x300 [ 468.282094] ? arch_local_save_flags+0x40/0x40 [ 468.286672] ? lock_release+0x970/0x970 [ 468.290649] __should_failslab+0x124/0x180 [ 468.294886] should_failslab+0x9/0x14 [ 468.298688] kmem_cache_alloc+0x2be/0x730 [ 468.302896] ? check_preemption_disabled+0x48/0x200 [ 468.307927] getname_flags+0xd0/0x5a0 [ 468.311729] user_path_at_empty+0x2d/0x50 [ 468.315887] do_sys_truncate+0xb0/0x190 [ 468.319877] ? vfs_truncate+0x840/0x840 [ 468.323864] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 468.329231] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 468.334686] __x64_sys_truncate+0x54/0x80 [ 468.338838] do_syscall_64+0x1b9/0x820 [ 468.342751] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 468.348129] ? syscall_return_slowpath+0x5e0/0x5e0 [ 468.353059] ? trace_hardirqs_on_caller+0x310/0x310 [ 468.358076] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 468.363089] ? recalc_sigpending_tsk+0x180/0x180 [ 468.367872] ? kasan_check_write+0x14/0x20 [ 468.372113] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 468.376957] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 468.382142] RIP: 0033:0x457579 [ 468.385334] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 468.404233] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 468.411945] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 14:02:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000012c700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 468.419206] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 468.426473] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 468.433749] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 [ 468.441010] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000007 14:02:06 executing program 3 (fault-call:8 fault-nth:1): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:06 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000159800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 468.561751] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 468.571959] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 468.611123] FAULT_INJECTION: forcing a failure. [ 468.611123] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 468.622943] CPU: 0 PID: 25502 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 468.630212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 468.639559] Call Trace: [ 468.642179] dump_stack+0x1c4/0x2b4 [ 468.645810] ? dump_stack_print_info.cold.2+0x52/0x52 [ 468.651018] should_fail.cold.4+0xa/0x17 [ 468.655082] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 468.660187] ? lock_acquire+0x1ed/0x520 [ 468.664163] ? __fdget_pos+0x1bb/0x200 [ 468.668055] ? mark_held_locks+0x130/0x130 [ 468.672292] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 468.677829] ? _kstrtoull+0x188/0x250 [ 468.681644] ? _parse_integer+0x180/0x180 [ 468.685792] ? lock_release+0x970/0x970 [ 468.689764] ? arch_local_save_flags+0x40/0x40 [ 468.694348] ? usercopy_warn+0x110/0x110 [ 468.698415] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 468.703950] ? should_fail+0x22d/0xd01 [ 468.708383] ? get_pid_task+0xd6/0x1a0 [ 468.713225] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 468.719371] __alloc_pages_nodemask+0x34b/0xde0 [ 468.725278] ? pid_task+0x115/0x200 [ 468.729595] ? find_vpid+0xf0/0xf0 [ 468.733928] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 468.738968] ? __f_unlock_pos+0x19/0x20 [ 468.742950] ? lock_downgrade+0x900/0x900 [ 468.747101] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 468.752635] ? proc_fail_nth_write+0x9e/0x210 [ 468.757130] ? fs_reclaim_acquire+0x20/0x20 [ 468.761448] ? lock_downgrade+0x900/0x900 [ 468.765595] ? ___might_sleep+0x1ed/0x300 [ 468.769742] ? trace_hardirqs_off+0xb8/0x310 [ 468.774153] cache_grow_begin+0x91/0x8c0 [ 468.778216] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 468.783751] ? check_preemption_disabled+0x48/0x200 [ 468.788783] kmem_cache_alloc+0x665/0x730 [ 468.792932] ? check_preemption_disabled+0x48/0x200 [ 468.797953] getname_flags+0xd0/0x5a0 [ 468.801752] user_path_at_empty+0x2d/0x50 [ 468.805904] do_sys_truncate+0xb0/0x190 [ 468.809921] ? vfs_truncate+0x840/0x840 [ 468.813896] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 468.819258] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 468.824709] __x64_sys_truncate+0x54/0x80 [ 468.828873] do_syscall_64+0x1b9/0x820 [ 468.832761] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 468.838127] ? syscall_return_slowpath+0x5e0/0x5e0 [ 468.843059] ? trace_hardirqs_on_caller+0x310/0x310 [ 468.848076] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 468.853093] ? recalc_sigpending_tsk+0x180/0x180 [ 468.858375] ? kasan_check_write+0x14/0x20 [ 468.862614] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 468.867463] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 468.872648] RIP: 0033:0x457579 [ 468.875839] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 468.894927] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 468.903413] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 [ 468.911306] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 468.920134] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 468.928785] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 [ 468.936051] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000007 14:02:06 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000b301) 14:02:06 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) read$FUSE(r1, &(0x7f00000030c0), 0x1000) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:06 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:06 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20003601) 14:02:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000ecd00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 469.102637] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:06 executing program 3 (fault-call:8 fault-nth:2): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:06 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000012a500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:06 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 469.248161] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 469.264622] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 469.295631] FAULT_INJECTION: forcing a failure. [ 469.295631] name failslab, interval 1, probability 0, space 0, times 0 [ 469.318128] CPU: 0 PID: 25548 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 469.325418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 469.334782] Call Trace: [ 469.337375] dump_stack+0x1c4/0x2b4 14:02:07 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000e4900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 469.341019] ? dump_stack_print_info.cold.2+0x52/0x52 [ 469.346221] should_fail.cold.4+0xa/0x17 [ 469.346245] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 469.355840] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 469.360976] ? __find_get_block+0x3be/0xf20 [ 469.365314] ? try_to_free_buffers+0xc80/0xc80 [ 469.369918] ? ___might_sleep+0x1ed/0x300 [ 469.374077] ? arch_local_save_flags+0x40/0x40 [ 469.378673] ? arch_local_save_flags+0x40/0x40 [ 469.383273] ? __might_sleep+0x95/0x190 [ 469.387249] ? ___might_sleep+0x1ed/0x300 [ 469.391394] ? arch_local_save_flags+0x40/0x40 [ 469.396033] ? __ext4_get_inode_loc+0x470/0x1330 [ 469.400795] __should_failslab+0x124/0x180 [ 469.405027] should_failslab+0x9/0x14 [ 469.408831] kmem_cache_alloc+0x2be/0x730 [ 469.412990] ? kasan_check_write+0x14/0x20 [ 469.417225] ? __brelse+0x104/0x180 [ 469.420905] mb_cache_entry_create+0x143/0xb30 [ 469.425519] ? mb_cache_scan+0x50/0x50 [ 469.429471] ? ext4_xattr_inode_set_class+0x60/0x60 [ 469.434503] ? smk_access+0x53b/0x700 [ 469.438304] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 469.443875] ext4_xattr_get+0x5ef/0xb30 [ 469.447886] ? ext4_xattr_ibody_get+0x630/0x630 [ 469.452572] ? kasan_check_read+0x11/0x20 [ 469.456715] ? __sanitizer_cov_trace_cmp1+0x17/0x20 [ 469.461754] ? xattr_resolve_name+0x330/0x430 [ 469.466252] ext4_xattr_security_get+0x32/0x40 [ 469.470866] vfs_getxattr_alloc+0x1ce/0x3c0 [ 469.475187] ? ext4_xattr_security_set+0x40/0x40 [ 469.479946] ? path_setxattr+0x230/0x230 [ 469.484014] cap_inode_getsecurity+0x104/0x820 [ 469.488599] ? sched_set_itmt_core_prio+0x14a/0x1d0 [ 469.493617] ? rootid_owns_currentns+0x1d0/0x1d0 [ 469.498376] ? smk_access+0x53b/0x700 [ 469.502180] security_inode_getsecurity+0xe1/0x130 [ 469.507108] vfs_getxattr+0x2ae/0x390 [ 469.510908] ? xattr_permission+0x310/0x310 [ 469.515227] ? ovl_dentry_real+0x210/0x210 [ 469.519465] ovl_xattr_get+0x76/0xb0 [ 469.523176] ovl_other_xattr_get+0x35/0x40 [ 469.527409] ? ovl_other_xattr_set+0x50/0x50 [ 469.531827] __vfs_getxattr+0xee/0x150 [ 469.535726] ? __vfs_setxattr+0x180/0x180 [ 469.539893] ? smack_inode_permission+0x2bc/0x3b0 [ 469.544749] cap_inode_need_killpriv+0x40/0x60 [ 469.549327] security_inode_need_killpriv+0x4c/0xa0 [ 469.554353] dentry_needs_remove_privs.part.25+0x22/0x70 [ 469.559804] dentry_needs_remove_privs+0x82/0xa2 [ 469.564559] do_truncate+0x149/0x2d0 [ 469.568272] ? file_open_root+0x580/0x580 [ 469.572418] ? inode_permission+0xb2/0x560 [ 469.576655] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 469.582192] ? security_inode_permission+0xd2/0x100 [ 469.587211] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 469.592749] vfs_truncate+0x60e/0x840 [ 469.596551] ? do_truncate+0x2d0/0x2d0 [ 469.600443] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 469.605980] ? getname_flags+0x26e/0x5a0 [ 469.610070] do_sys_truncate+0x156/0x190 [ 469.614133] ? vfs_truncate+0x840/0x840 [ 469.618110] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 469.623485] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 469.628937] __x64_sys_truncate+0x54/0x80 [ 469.633088] do_syscall_64+0x1b9/0x820 [ 469.636976] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 469.642356] ? syscall_return_slowpath+0x5e0/0x5e0 [ 469.647285] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 469.652128] ? trace_hardirqs_on_caller+0x310/0x310 [ 469.657143] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 469.662170] ? prepare_exit_to_usermode+0x291/0x3b0 [ 469.667710] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 469.673509] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 469.679155] RIP: 0033:0x457579 [ 469.682356] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 469.701256] RSP: 002b:00007fc8058e0c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 469.708965] RAX: ffffffffffffffda RBX: 00007fc8058e0c90 RCX: 0000000000457579 [ 469.716226] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 469.723493] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 469.730760] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058e16d4 [ 469.738023] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000005 14:02:07 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:07 executing program 3 (fault-call:8 fault-nth:3): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:07 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000d3d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 469.820380] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:07 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000db00) [ 469.874374] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 469.957218] FAULT_INJECTION: forcing a failure. [ 469.957218] name failslab, interval 1, probability 0, space 0, times 0 14:02:07 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) rmdir(&(0x7f0000000200)='./file0\x00') r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r3 = getpid() fcntl$lock(r0, 0x7, &(0x7f00000001c0)={0x2, 0x4, 0x6, 0x7fffffff, r3}) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x1000) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x2400, 0x6) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f0000001000), 0x1000) 14:02:07 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x0, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 470.000340] CPU: 0 PID: 25576 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 470.007643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 470.016990] Call Trace: [ 470.019583] dump_stack+0x1c4/0x2b4 [ 470.023214] ? dump_stack_print_info.cold.2+0x52/0x52 [ 470.028408] ? get_page_from_freelist+0x488b/0x5340 [ 470.033428] should_fail.cold.4+0xa/0x17 [ 470.037494] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 470.042604] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 470.047627] ? is_bpf_text_address+0xac/0x170 [ 470.052122] ? lock_downgrade+0x900/0x900 [ 470.056274] ? mark_held_locks+0x130/0x130 [ 470.060508] ? kasan_check_read+0x11/0x20 [ 470.064656] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 470.069930] ? rcu_bh_qs+0xc0/0xc0 [ 470.073472] ? unwind_dump+0x190/0x190 [ 470.077370] ? ___might_sleep+0x1ed/0x300 [ 470.081517] ? arch_local_save_flags+0x40/0x40 [ 470.086100] ? __kernel_text_address+0xd/0x40 [ 470.090597] ? unwind_get_return_address+0x61/0xa0 [ 470.095528] __should_failslab+0x124/0x180 [ 470.099761] should_failslab+0x9/0x14 [ 470.103570] kmem_cache_alloc+0x2be/0x730 [ 470.107719] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.113258] ? dax_layout_busy_page+0x5b4/0x960 [ 470.117926] ? save_stack+0xa9/0xd0 [ 470.121817] jbd2__journal_start+0x1e7/0xa90 [ 470.126253] ? arch_local_save_flags+0x40/0x40 [ 470.130852] ? jbd2_write_access_granted.part.8+0x410/0x410 [ 470.136597] ? __get_unlocked_mapping_entry+0x5f0/0x5f0 [ 470.141956] ? __might_sleep+0x95/0x190 [ 470.145934] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.151533] __ext4_journal_start_sb+0x1a5/0x5f0 [ 470.156292] ? ext4_truncate+0x4cc/0x1650 [ 470.160441] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 470.166152] ? ext4_ext_index_trans_blocks+0x11f/0x150 [ 470.171429] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.176962] ? ext4_meta_trans_blocks+0x25f/0x310 [ 470.181806] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.187338] ? ext4_writepage_trans_blocks+0x182/0x350 [ 470.192614] ext4_truncate+0x4cc/0x1650 [ 470.196585] ? up_write+0x7b/0x220 [ 470.200123] ? up_read+0x110/0x110 [ 470.203751] ? ext4_punch_hole+0x11e0/0x11e0 [ 470.208173] ? do_wp_page+0x1390/0x1390 [ 470.212145] ? smack_log+0x423/0x590 [ 470.215877] ? down_write+0x8a/0x130 [ 470.219953] ? unmap_mapping_range+0x48/0x60 [ 470.224364] ext4_setattr+0x1831/0x28f0 [ 470.228340] ? smack_privileged+0xd0/0xd0 [ 470.232483] ? current_time+0x72/0x1b0 [ 470.236401] ? ext4_journalled_write_end+0x1680/0x1680 [ 470.241676] ? smk_curacc+0x7f/0xa0 [ 470.245304] ? smack_inode_setattr+0xb3/0x270 [ 470.249798] ? smack_inode_rename+0x370/0x370 [ 470.254292] ? current_time+0x131/0x1b0 [ 470.258269] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.263880] ? evm_inode_setattr+0x6f/0x170 [ 470.268208] ? ext4_journalled_write_end+0x1680/0x1680 [ 470.273484] notify_change+0xbde/0x1110 [ 470.277462] ? setattr_prepare+0x830/0x830 [ 470.281698] ? down_read+0x1d0/0x1d0 [ 470.285416] ovl_setattr+0x398/0xaf0 [ 470.289129] ? ovl_fill_inode+0x6f0/0x6f0 [ 470.293279] ? smack_inode_rename+0x370/0x370 [ 470.297771] ? lock_acquire+0x1ed/0x520 [ 470.301745] ? current_time+0x131/0x1b0 [ 470.305717] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.311253] ? ovl_fill_inode+0x6f0/0x6f0 [ 470.315405] notify_change+0xbde/0x1110 [ 470.319382] ? setattr_prepare+0x830/0x830 [ 470.323622] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.329160] ? dentry_needs_remove_privs.part.25+0x54/0x70 [ 470.334782] do_truncate+0x1bd/0x2d0 [ 470.338499] ? file_open_root+0x580/0x580 [ 470.342642] ? inode_permission+0xb2/0x560 [ 470.346895] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.352435] vfs_truncate+0x60e/0x840 [ 470.356235] ? do_truncate+0x2d0/0x2d0 [ 470.360125] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.365657] ? getname_flags+0x26e/0x5a0 [ 470.369720] do_sys_truncate+0x156/0x190 [ 470.373780] ? vfs_truncate+0x840/0x840 [ 470.377753] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 470.383120] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 470.388585] __x64_sys_truncate+0x54/0x80 [ 470.392736] do_syscall_64+0x1b9/0x820 [ 470.396621] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 470.401985] ? syscall_return_slowpath+0x5e0/0x5e0 [ 470.406911] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 470.411748] ? trace_hardirqs_on_caller+0x310/0x310 [ 470.416762] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 470.421799] ? prepare_exit_to_usermode+0x291/0x3b0 [ 470.426836] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 470.431700] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 470.436886] RIP: 0033:0x457579 [ 470.440078] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 470.458974] RSP: 002b:00007fc8058e0c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 470.466682] RAX: ffffffffffffffda RBX: 00007fc8058e0c90 RCX: 0000000000457579 [ 470.473957] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 470.481234] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 470.488500] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058e16d4 14:02:08 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20004e00) 14:02:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000014e700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 470.495765] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000003 [ 470.517788] EXT4-fs error (device sda1) in ext4_setattr:5631: Out of memory [ 470.527739] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:08 executing program 3 (fault-call:8 fault-nth:4): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r2 = getegid() mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r2}}) r3 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x1000, 0x80) ioctl$TIOCGWINSZ(r3, 0x5413, &(0x7f00000001c0)) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) getsockopt$inet6_udp_int(r3, 0x11, 0x66, &(0x7f0000000200), &(0x7f0000000240)=0x4) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="757365722e2f6465762f7573626d6f6e2300aca9e0e38d851f2083f2f049573c23725926c9dfc6c9ed63831f0bfa16690a260f2d5873a47bc1c945ce4c643b603965cf2392f673fdf5f4f3410000000000000000000000"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:08 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x0, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000200)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f0000001000), 0x1000) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) capset(&(0x7f0000000100)={0x20071026, r3}, &(0x7f00000001c0)={0x100, 0x9, 0x4, 0x5, 0xfffffffffffffffd, 0x8}) [ 470.727928] FAULT_INJECTION: forcing a failure. [ 470.727928] name failslab, interval 1, probability 0, space 0, times 0 [ 470.751917] CPU: 0 PID: 25617 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 470.759209] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 470.768569] Call Trace: [ 470.771179] dump_stack+0x1c4/0x2b4 [ 470.774823] ? dump_stack_print_info.cold.2+0x52/0x52 [ 470.780212] ? kernel_text_address+0x79/0xf0 [ 470.780234] should_fail.cold.4+0xa/0x17 [ 470.780252] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 470.780270] ? save_stack+0x43/0xd0 [ 470.796344] ? __kasan_slab_free+0x102/0x150 [ 470.796357] ? kasan_slab_free+0xe/0x10 [ 470.796372] ? kmem_cache_free+0x83/0x290 [ 470.796387] ? __ext4_journal_stop+0xde/0x1f0 [ 470.796405] ? ext4_truncate+0x667/0x1650 [ 470.821509] ? ext4_setattr+0x1831/0x28f0 [ 470.825667] ? notify_change+0xbde/0x1110 [ 470.829829] ? ovl_setattr+0x398/0xaf0 [ 470.834613] ? notify_change+0xbde/0x1110 [ 470.838748] ? do_truncate+0x1bd/0x2d0 [ 470.842633] ? vfs_truncate+0x60e/0x840 [ 470.846589] ? do_sys_truncate+0x156/0x190 [ 470.850807] ? __x64_sys_truncate+0x54/0x80 [ 470.855114] ? do_syscall_64+0x1b9/0x820 [ 470.859160] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 470.864512] ? do_raw_spin_unlock+0xa7/0x2f0 [ 470.868906] ? trace_hardirqs_on+0x310/0x310 [ 470.873298] ? kasan_check_write+0x14/0x20 [ 470.877523] ? trace_hardirqs_off+0xb8/0x310 [ 470.881926] ? trace_hardirqs_on+0x310/0x310 [ 470.886326] ? debug_check_no_obj_freed+0x305/0x58d [ 470.891331] ? ___might_sleep+0x1ed/0x300 [ 470.895465] ? check_preemption_disabled+0x48/0x200 [ 470.900467] ? arch_local_save_flags+0x40/0x40 [ 470.905035] ? trace_hardirqs_on+0xbd/0x310 [ 470.909343] ? jbd2_journal_stop+0x430/0x15d0 [ 470.913830] __should_failslab+0x124/0x180 [ 470.918065] should_failslab+0x9/0x14 [ 470.921878] kmem_cache_alloc+0x2be/0x730 [ 470.926036] ? kmem_cache_free+0x21a/0x290 [ 470.930254] ? jbd2_journal_stop+0x234/0x15d0 [ 470.934739] jbd2__journal_start+0x1e7/0xa90 [ 470.939133] ? arch_local_save_flags+0x40/0x40 [ 470.943703] ? jbd2_write_access_granted.part.8+0x410/0x410 [ 470.949670] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.955210] ? __might_sleep+0x95/0x190 [ 470.959177] ? ext4_mark_inode_dirty+0x26f/0xb30 [ 470.963927] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.969459] __ext4_journal_start_sb+0x1a5/0x5f0 [ 470.974209] ? ext4_dirty_inode+0x62/0xc0 [ 470.978347] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 470.984049] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 470.989596] ? inode_init_owner+0x340/0x340 [ 470.993920] ? ext4_setattr+0x28f0/0x28f0 [ 470.998052] ext4_dirty_inode+0x62/0xc0 [ 471.002026] __mark_inode_dirty+0x7c3/0x1510 [ 471.006419] ? __inode_attach_wb+0x13f0/0x13f0 [ 471.010989] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 471.016523] ? ext4_truncate+0xb2f/0x1650 [ 471.020658] ? up_write+0x7b/0x220 [ 471.024187] ? ext4_setattr+0x1632/0x28f0 [ 471.028325] ? lock_downgrade+0x900/0x900 [ 471.032473] ? do_wp_page+0x1390/0x1390 [ 471.036433] ? smack_log+0x423/0x590 [ 471.040143] ? up_write+0x7b/0x220 [ 471.043667] ? up_read+0x110/0x110 [ 471.047205] ? unmap_mapping_range+0x48/0x60 [ 471.051614] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.057134] ext4_setattr+0x1b91/0x28f0 [ 471.061095] ? smack_privileged+0xd0/0xd0 [ 471.065229] ? current_time+0x72/0x1b0 [ 471.069127] ? ext4_journalled_write_end+0x1680/0x1680 [ 471.074390] ? smk_curacc+0x7f/0xa0 [ 471.078006] ? smack_inode_setattr+0xb3/0x270 [ 471.082497] ? smack_inode_rename+0x370/0x370 [ 471.086976] ? current_time+0x131/0x1b0 [ 471.090946] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.096489] ? evm_inode_setattr+0x6f/0x170 [ 471.100812] ? ext4_journalled_write_end+0x1680/0x1680 [ 471.106072] notify_change+0xbde/0x1110 [ 471.110031] ? setattr_prepare+0x830/0x830 [ 471.114262] ? down_read+0x1d0/0x1d0 [ 471.117972] ovl_setattr+0x398/0xaf0 [ 471.121670] ? ovl_fill_inode+0x6f0/0x6f0 [ 471.125804] ? smack_inode_rename+0x370/0x370 [ 471.130286] ? lock_acquire+0x1ed/0x520 [ 471.134259] ? current_time+0x131/0x1b0 [ 471.138233] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.143755] ? ovl_fill_inode+0x6f0/0x6f0 [ 471.147889] notify_change+0xbde/0x1110 [ 471.152289] ? setattr_prepare+0x830/0x830 [ 471.157205] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.163176] ? dentry_needs_remove_privs.part.25+0x54/0x70 [ 471.168789] do_truncate+0x1bd/0x2d0 [ 471.172487] ? file_open_root+0x580/0x580 [ 471.176616] ? inode_permission+0xb2/0x560 [ 471.180838] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.186377] vfs_truncate+0x60e/0x840 [ 471.190170] ? do_truncate+0x2d0/0x2d0 [ 471.194042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.199577] ? getname_flags+0x26e/0x5a0 [ 471.203627] do_sys_truncate+0x156/0x190 [ 471.207683] ? vfs_truncate+0x840/0x840 [ 471.211655] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 471.217003] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 471.222441] __x64_sys_truncate+0x54/0x80 [ 471.226576] do_syscall_64+0x1b9/0x820 [ 471.230450] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 471.235815] ? syscall_return_slowpath+0x5e0/0x5e0 [ 471.240730] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 471.245584] ? trace_hardirqs_on_caller+0x310/0x310 [ 471.250588] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 471.255604] ? prepare_exit_to_usermode+0x291/0x3b0 [ 471.260613] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 471.265444] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 471.270616] RIP: 0033:0x457579 [ 471.273794] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 471.292686] RSP: 002b:00007fc8058e0c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 471.300727] RAX: ffffffffffffffda RBX: 00007fc8058e0c90 RCX: 0000000000457579 [ 471.307979] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 471.315248] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 471.322501] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058e16d4 14:02:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001c1300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:09 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000f501) 14:02:09 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x0, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 471.329770] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000005 14:02:09 executing program 3 (fault-call:8 fault-nth:5): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:09 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000024) 14:02:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000a4b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 471.504022] FAULT_INJECTION: forcing a failure. [ 471.504022] name failslab, interval 1, probability 0, space 0, times 0 [ 471.517632] CPU: 0 PID: 25650 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 471.524918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 471.534266] Call Trace: [ 471.536842] dump_stack+0x1c4/0x2b4 [ 471.540486] ? dump_stack_print_info.cold.2+0x52/0x52 [ 471.545700] ? kernel_text_address+0x79/0xf0 [ 471.550124] should_fail.cold.4+0xa/0x17 [ 471.554173] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 471.559265] ? save_stack+0x43/0xd0 [ 471.562920] ? __kasan_slab_free+0x102/0x150 [ 471.567327] ? kasan_slab_free+0xe/0x10 [ 471.567342] ? kmem_cache_free+0x83/0x290 [ 471.567357] ? __ext4_journal_stop+0xde/0x1f0 [ 471.567370] ? ext4_truncate+0x667/0x1650 [ 471.567389] ? ext4_setattr+0x1831/0x28f0 [ 471.583830] ? notify_change+0xbde/0x1110 [ 471.583853] ? ovl_setattr+0x398/0xaf0 [ 471.583887] ? notify_change+0xbde/0x1110 [ 471.583900] ? do_truncate+0x1bd/0x2d0 [ 471.583912] ? vfs_truncate+0x60e/0x840 [ 471.583930] ? do_sys_truncate+0x156/0x190 [ 471.620878] ? __x64_sys_truncate+0x54/0x80 [ 471.625210] ? do_syscall_64+0x1b9/0x820 [ 471.629260] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 471.634621] ? do_raw_spin_unlock+0xa7/0x2f0 [ 471.639034] ? trace_hardirqs_on+0x310/0x310 [ 471.643437] ? kasan_check_write+0x14/0x20 [ 471.647661] ? trace_hardirqs_off+0xb8/0x310 [ 471.652071] ? trace_hardirqs_on+0x310/0x310 [ 471.656464] ? debug_check_no_obj_freed+0x305/0x58d [ 471.661512] ? ___might_sleep+0x1ed/0x300 [ 471.665646] ? check_preemption_disabled+0x48/0x200 [ 471.670669] ? arch_local_save_flags+0x40/0x40 [ 471.675622] ? trace_hardirqs_on+0xbd/0x310 [ 471.680284] ? jbd2_journal_stop+0x430/0x15d0 [ 471.684781] __should_failslab+0x124/0x180 [ 471.689016] should_failslab+0x9/0x14 [ 471.692806] kmem_cache_alloc+0x2be/0x730 [ 471.696941] ? kmem_cache_free+0x21a/0x290 [ 471.701174] ? jbd2_journal_stop+0x234/0x15d0 [ 471.705692] jbd2__journal_start+0x1e7/0xa90 [ 471.710113] ? arch_local_save_flags+0x40/0x40 [ 471.714699] ? jbd2_write_access_granted.part.8+0x410/0x410 [ 471.720396] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.725920] ? __might_sleep+0x95/0x190 [ 471.729897] ? ext4_mark_inode_dirty+0x26f/0xb30 [ 471.734665] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.740203] __ext4_journal_start_sb+0x1a5/0x5f0 [ 471.744985] ? ext4_dirty_inode+0x62/0xc0 [ 471.749127] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 471.754879] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.760435] ? inode_init_owner+0x340/0x340 [ 471.764759] ? ext4_setattr+0x28f0/0x28f0 [ 471.768906] ext4_dirty_inode+0x62/0xc0 [ 471.772876] __mark_inode_dirty+0x7c3/0x1510 [ 471.777271] ? __inode_attach_wb+0x13f0/0x13f0 [ 471.781840] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 471.787399] ? ext4_truncate+0xb2f/0x1650 [ 471.791547] ? up_write+0x7b/0x220 [ 471.795089] ? ext4_setattr+0x1632/0x28f0 [ 471.799236] ? lock_downgrade+0x900/0x900 [ 471.803374] ? do_wp_page+0x1390/0x1390 [ 471.807341] ? smack_log+0x423/0x590 [ 471.811058] ? up_write+0x7b/0x220 [ 471.814582] ? up_read+0x110/0x110 [ 471.818111] ? unmap_mapping_range+0x48/0x60 [ 471.822503] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.828028] ext4_setattr+0x1b91/0x28f0 [ 471.832006] ? smack_privileged+0xd0/0xd0 [ 471.836150] ? current_time+0x72/0x1b0 [ 471.840042] ? ext4_journalled_write_end+0x1680/0x1680 [ 471.845314] ? smk_curacc+0x7f/0xa0 [ 471.848968] ? smack_inode_setattr+0xb3/0x270 [ 471.853447] ? smack_inode_rename+0x370/0x370 [ 471.857943] ? current_time+0x131/0x1b0 [ 471.861905] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.867441] ? evm_inode_setattr+0x6f/0x170 [ 471.871757] ? ext4_journalled_write_end+0x1680/0x1680 [ 471.877022] notify_change+0xbde/0x1110 [ 471.880985] ? setattr_prepare+0x830/0x830 [ 471.885213] ? down_read+0x1d0/0x1d0 [ 471.888925] ovl_setattr+0x398/0xaf0 [ 471.892629] ? ovl_fill_inode+0x6f0/0x6f0 [ 471.896761] ? smack_inode_rename+0x370/0x370 [ 471.901244] ? lock_acquire+0x1ed/0x520 [ 471.905221] ? current_time+0x131/0x1b0 [ 471.909184] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.914709] ? ovl_fill_inode+0x6f0/0x6f0 [ 471.918853] notify_change+0xbde/0x1110 [ 471.922831] ? setattr_prepare+0x830/0x830 [ 471.927083] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.932602] ? dentry_needs_remove_privs.part.25+0x54/0x70 [ 471.938212] do_truncate+0x1bd/0x2d0 [ 471.941920] ? file_open_root+0x580/0x580 [ 471.946061] ? inode_permission+0xb2/0x560 [ 471.950286] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.955810] vfs_truncate+0x60e/0x840 [ 471.959628] ? do_truncate+0x2d0/0x2d0 [ 471.963517] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 471.969333] ? getname_flags+0x26e/0x5a0 [ 471.973395] do_sys_truncate+0x156/0x190 [ 471.977456] ? vfs_truncate+0x840/0x840 [ 471.981420] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 471.986772] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 471.992209] __x64_sys_truncate+0x54/0x80 [ 471.996344] do_syscall_64+0x1b9/0x820 [ 472.000221] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 472.005572] ? syscall_return_slowpath+0x5e0/0x5e0 [ 472.010495] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 472.015339] ? trace_hardirqs_on_caller+0x310/0x310 [ 472.020342] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 472.025350] ? prepare_exit_to_usermode+0x291/0x3b0 [ 472.030354] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 472.035198] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 472.040385] RIP: 0033:0x457579 [ 472.043562] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 472.062464] RSP: 002b:00007fc8058e0c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 472.070156] RAX: ffffffffffffffda RBX: 00007fc8058e0c90 RCX: 0000000000457579 [ 472.077418] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 472.084682] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 472.091944] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058e16d4 [ 472.099215] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000005 14:02:09 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x1000) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x9) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000100)) read$FUSE(r2, &(0x7f0000001000), 0x1000) 14:02:09 executing program 3 (fault-call:8 fault-nth:6): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:09 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)) chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:09 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000013f) 14:02:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000084900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:10 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:10 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001e4) 14:02:10 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)) chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000170200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:10 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xffffff7f00000000) 14:02:10 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)) chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000014f700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 472.635112] overlayfs: './file0' not a directory 14:02:10 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x2000000) 14:02:10 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488d") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='nd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr$security_selinux(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='security.selinux\x00', &(0x7f0000000200)='system_u:object_r:semanage_store_t:s0\x00', 0xfffffce2, 0x1) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="ecff000003000000010000000069b80001000000000000000700000000000000757365725f696400"], 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x80, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f00000003c0)={'NETMAP\x00'}, &(0x7f0000000480)=0x1e) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:10 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000cd) 14:02:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000119200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 473.110436] __ntfs_error: 12 callbacks suppressed [ 473.110446] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='environ\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2800000003009b96dd812efaaa370000010000fd4b79d2351ff8430000000000757365725f6964005d0674752ffce90010d7ca56f58d13998888e89ed305b4f371e83854acce6ded288c75260bb5b325b2482475437fa1728a15bbf4f9e243f5ebdef099e99dcb5e0cc24b458592ce0309c13ad725b34a5c4e031c10da0c01e1c99dc81413e93ab307ca17179d6b1545e75e1a"], 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x11c5) write$FUSE_INIT(r1, &(0x7f0000000200)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) clock_gettime(0x0, &(0x7f0000000540)={0x0, 0x0}) utimensat(r0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000580)={{r2, r3/1000+30000}, {0x77359400}}, 0x100) setxattr$security_capability(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.capability\x00', &(0x7f00000003c0)=@v1={0x1000000, [{0x8001, 0x8001}]}, 0xc, 0x2) read$FUSE(r1, &(0x7f0000001000), 0x1000) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ashmem\x00', 0x0, 0x0) [ 473.229907] overlayfs: './file0' not a directory 14:02:11 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20003301) 14:02:11 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488d") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000000df00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:11 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x2) [ 473.343330] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 473.372901] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:11 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488d") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 473.441280] overlayfs: './file0' not a directory 14:02:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000034e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 473.463329] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:11 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x8cffffff00000000) [ 473.531146] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000b6d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:11 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d76") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 473.632921] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 473.692490] overlayfs: './file0' not a directory [ 473.714428] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 473.791284] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:11 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000144) 14:02:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000172800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:11 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x3f00000000000000) 14:02:11 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000c601) 14:02:11 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d76") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000047400637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e21, 0xfffffffffffffff7, @mcast1, 0x9}, 0x1c) r2 = syz_open_dev$dmmidi(&(0x7f0000000680)='/dev/dmmidi#\x00', 0x1, 0x10180) mkdirat(r2, &(0x7f00000006c0)='./file0\x00', 0x40) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) r4 = open(&(0x7f00000001c0)='.\x00', 0x1, 0x8) sendmsg$nl_netfilter(r4, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f0000000480)={0x1c4, 0x10, 0xb, 0x10, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x8}, [@generic="28ff8446247c116e8c980710103e303dfb704edcde57d44cda343f1ac3947a2fc8aac461e16923ceab973424be2e89a4896aa63d12750eb28f0b7ba80954a98d87aa4a7ea85c2e13f274e81bdb8b7ccb550e071f37e8400af912cd8ef2b542a20b9365d8998f592f547a542ef52ece079038ed283beea86b725fa4deb3e27f9d07b8d41e796ec21bfa8cd3e861c84e44e2721fb7fc613e87897cf9fd933a465c151b819c4545a47a6116701a922774d75f6741729c1c7302d814803013c41c", @generic="5afe03a04ffde25b4b94ede346e95f9f1512cced564fc2f63c3a5ff4dac2dddfd301e3070b2b5da9", @nested={0xc8, 0x1e, [@generic="ec058e0252e4c4f60a97c8b948757fefc964cdcc188c8bc2a37dbb829fc86af36f516860c9ec683e07c1", @typed={0xc, 0x2, @u64=0x8000}, @generic="acbe181c784b54d116eaf76f081412964a23ffead73e7dcece6a79fc4fe8b5df246b4ba8851dd25e0fdc75f9f3a5e3715868a88fa820871410ad063e762b0aef7178818e640fb564e4079f07771aa3128731ab783df7e3a14eb55490bca47b693bd216e1e1c5b448aec890dcaa9ca074f82cce6dbb197219cdadfd6a9c687d504650cf88665c5d42e5765b57"]}]}, 0x1c4}, 0x1, 0x0, 0x0, 0x20000080}, 0x24000081) read$FUSE(r3, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r3, &(0x7f0000000280)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x5}}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r3, &(0x7f0000001000), 0x1000) [ 474.219816] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:12 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r2 = request_key(&(0x7f0000000100)='user\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000200)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0xfffffffffffffffb) keyctl$revoke(0x3, r2) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 474.267681] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:12 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x1000000) 14:02:12 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d76") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:12 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000a3900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 474.440975] overlayfs: './file0' not a directory 14:02:12 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000d1400637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:12 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000e00) 14:02:12 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xfffffff4) 14:02:12 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d7660") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:12 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20003f00) 14:02:12 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000155100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:12 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xfffffffe) 14:02:12 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d7660") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:13 executing program 5: socketpair$unix(0x1, 0xbfffffffffffffff, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:13 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d7660") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:13 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x100000000000000) 14:02:13 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000019af00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:13 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xfeffffff00000000) [ 475.448475] overlayfs: './file0' not a directory 14:02:13 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000075) 14:02:13 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000017b200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:13 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:13 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002200) 14:02:13 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x400000000000000) 14:02:13 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000022d700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:13 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:13 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000c80), &(0x7f0000000cc0)=0x30) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f00000003c0)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0, 0x0}, &(0x7f00000004c0)=0xc) mount$fuse(0x0, &(0x7f0000000100)='./file0/file0\x00', &(0x7f00000001c0)='fuse\x00', 0x840, &(0x7f0000000500)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0xf000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@allow_other='allow_other'}], [{@obj_type={'obj_type', 0x3d, '/dev/usbmon#\x00'}}]}}) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) syz_mount_image$reiserfs(&(0x7f00000005c0)='reiserfs\x00', &(0x7f0000000600)='./file0\x00', 0x4, 0x4, &(0x7f0000000b00)=[{&(0x7f0000000640)="246c2c9b3bef20df0b89e4ab286918bf8cb1bc3aa5518547b5f3f69d4940d8f654e63b3e453691fbb422b88127a08a790747df21e3e9395eacbf6a653658a3294ebb8e4fbf203a7720dbff5dc301be4a3e9e150f4591f0b2c4710ea63089db06ce7247dd1711df047859c7c295d00777a1bbb6875b1848ffce92f1b4851be9bfbdc423d5dda83674b73fa149547a065f1fc4cf58e8ad5600d1142205dc6d86943c61d22834f30fec9505cc9e90cde2862f7ff5589a7be4227c297da713a4df76ffec27e27f2b8df9e312c7c02b9fe7bd8ca13f172e6c87f57d0691b25252ad4c59f44bf4893372479709507c1846fc6b1a78dd26c6ad479944566e", 0xfb}, {&(0x7f0000000800)="83328fd7124c98c05e2a8ef427dd0f341a32d9b11a2bce7c01663a8d79cd2471b85c411c6c28593c24a2158638bc98a29c90ce02da0d64f0f4ce6309663ec1b5106ffe8d85dad2a4ec39d2f17115421c688bba5b88b8c8662ccee6295d1b8d24157166be3f5370739214907e7250e268daca8c9429fb042562eedd4cbd54c9efb53ef86a8025f715104cf66fe21bd11385b0d50e6cfc5894665dc2fb3f425ebef0ce22269a68a736d10fc46f3920c79849d0431cc0718afc9d9a05b771bbe16b4620bd536118731b9dcca37d12e1a3978e71231921efbb58645ebf7f934ee356a739de4ec8a73ebc", 0xe8, 0x4}, {&(0x7f0000000900)="9e6548f8de00bfcbc01a2e943aa8ae47e68796676a6eef7723ff20cf536d676e64ff70b8c7faf52b7b68a4b17571933e5884e2fbaca375fd68b2dbc83215572e208ae4bb761d2b56d66a936003d2e22f456cfaeeb2680d107877458da1193ee57e4cf4db67b3edcf55a3394028ed95826fb7a37bda3b9341ad125437fee9e9cd495ebbc3ec06f4466610db546975c7371da620001e90dd1ebda68a8e67c5c49ca811992732c82ce5617b46a59a9930d6606244d010868cd757f2295f81467ee174cd365f12d95edab6dd02", 0xcb, 0x100000000}, {&(0x7f0000000a00)="232038ca51bf326b0d2f137698f2a138065330aa64d022e88d3dd0a5c76c6b1a598ed82f5ca1b9d9c5dfb313b3ae90e6354e99bb60c18442d1753c6f9ec79a3c08ca95c5985eaafc76c0d72e3d3e21124b8deb19f4cb12c4afc96c5496477e9c46c0dd08f23b94439933fe357e6fb34e83a2207b8f1a042e767e6f4b7a1413182ebdb434a65283da5c6eed5a0c6b32a8354cad637ed8a61b68b2872669b0dccbeeb34cae2e80322d6706fdca9ca1915596050a1043134ce2b1cc0e5a85a69fd82f145f316b0826628d250d69d4ad7522db2cf5ce128b0a93f4a6867aac180f26ac0c", 0xe2, 0x3}], 0x4000, &(0x7f0000000b80)=ANY=[@ANYBLOB='resize=auto,grpjquota,hash=rupasov,data=writeback,data=writeback,block-allocator=border,errors=continue,dont_measure,appraise_type=imasig,appraise,appraise_type=imasig,euid>', @ANYRESDEC=r3, @ANYBLOB=',smackfsroot=fuse\x00,measure,uid<', @ANYRESDEC=r4, @ANYBLOB="2cc8b2f30d08f6c3ba0ab7fc"]) read$FUSE(r2, &(0x7f0000001000), 0x1000) 14:02:13 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:13 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x40000) 14:02:13 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000149a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000243400637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 476.259533] overlayfs: './file0' not a directory [ 476.421821] REISERFS warning (device loop5): super-6504 reiserfs_getopt: the option "grpjquota" requires an argument [ 476.421821] 14:02:14 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(0xffffffffffffffff, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:14 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x8040000) 14:02:14 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000c300) 14:02:14 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000035) 14:02:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000115300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 476.618564] overlayfs: './file0' not a directory 14:02:14 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x3000) 14:02:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4c, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180)}}}], 0x0, 0x0, &(0x7f0000000480)}) [ 476.765237] binder: 26074:26075 transaction failed 29189/-22, size 0-0 line 2855 [ 476.821332] binder: undelivered TRANSACTION_ERROR: 29189 [ 476.848111] overlayfs: './file0' not a directory [ 476.850818] IPVS: ftp: loaded support on port[0] = 21 [ 476.947537] device bridge_slave_1 left promiscuous mode [ 476.953220] bridge0: port 2(bridge_slave_1) entered disabled state [ 476.961296] device bridge_slave_0 left promiscuous mode [ 476.968323] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.002213] team0 (unregistering): Port device team_slave_1 removed [ 477.013861] team0 (unregistering): Port device team_slave_0 removed [ 477.025952] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 477.036089] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 477.056076] bond0 (unregistering): Released all slaves 14:02:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001eff00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:14 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x800000000002) ioctl(r0, 0x8912, &(0x7f00000000c0)="153f62344885d25d766070") r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c07, 0x0) 14:02:14 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x80, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r3, 0x2288, &(0x7f00000001c0)) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) io_setup(0x8, &(0x7f0000000200)=0x0) io_submit(r4, 0x4, &(0x7f0000000840)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x3, 0x100, r3, &(0x7f0000000480)="a8f989d021ec25d969a3c6e4dec716d232a79ffa44554f7e9c3ef80c0372c21fdb7ef708fb2fe56a6116f55a6a369cff692a346f5452d5cf9c278ae83c6d465819abad338b05c7a1f477d99adcf0730bda7625ac324b04e267f7dbec0afb04595ed73da66a1d01b1a820fb93acafe3481fd7f6d22776178eda2185e93ce204b8ce0445edfea114c5fd1dd4e411acc00257612bfb7f6e466f485200122d3f5e", 0x9f, 0x10003, 0x0, 0x1, r3}, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x5, 0x392, r2, &(0x7f0000000540)="a652959d719281a83a35159601c8a40e65d7d9a9fccda83635704e22c5279666d8d8262ac1f38afbca026c9e8450b0e6419ea8a5385c6bf3e8d44cff15bcaeb321d3fad2", 0x44, 0x172, 0x0, 0x2, r0}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x9, r3, &(0x7f00000005c0)="d103aa16cbdb9d2fc3c502cc20e01888928dc74d52fd67547544f9828fd4aa8f11891fd9c69922ca61be0778d274384cbb46ec74825e355af4b6a36ce22a25480a70a539427c2276ceec9537fefde5fd4e0f503b0fa44b01f0c3a189d7345bc418b809aaacfc043bfb248cb1b54d7ab74f6e0e4cc3abcc68abba24ebaa296fb5e2470e3a6d110747bd5a6210a11b4f0532653714d682ce3ae09773307f49d8b1e5771b101317c3f5f4254e0e5b4cfc9272e6ee15c6d38a85d51020214e2d13e9c9179e6b73a5db8c61adb3c8a81b0e03fc923cdb43c931fcff4bd3221e22478073b1259c212b9941ab57df03", 0xec, 0x7ff, 0x0, 0x1, r3}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x2, 0x80000001, r3, &(0x7f0000000700)="c09f3d35e6dfda", 0x7, 0x1, 0x0, 0x3, r3}]) read$FUSE(r2, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f0000001000), 0x1000) socket$netlink(0x10, 0x3, 0xf) 14:02:14 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xffffff8c) 14:02:14 executing program 2: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) lsetxattr$security_selinux(&(0x7f00000000c0)='./file0/../file0\x00', &(0x7f0000000180)='security.selinux\x00', &(0x7f0000000080)='system_u:object_r:bsdpty_device_t:s0\x00', 0x303, 0x0) 14:02:14 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xffffffeb) 14:02:15 executing program 2: r0 = socket$inet6(0xa, 0x2000000802, 0x0) sendmsg(r0, &(0x7f0000000000)={&(0x7f0000000100)=@in6={0xa, 0x4e24, 0x0, @dev}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000040)=ANY=[]}, 0x0) 14:02:15 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000a100) [ 477.947840] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.954635] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.962694] device bridge_slave_0 entered promiscuous mode [ 477.995769] bridge0: port 2(bridge_slave_1) entered blocking state [ 478.002269] bridge0: port 2(bridge_slave_1) entered disabled state [ 478.009299] device bridge_slave_1 entered promiscuous mode [ 478.031651] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 478.054327] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 478.115753] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 478.140414] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 478.233183] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 478.240405] team0: Port device team_slave_0 added [ 478.261810] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 478.268935] team0: Port device team_slave_1 added [ 478.290117] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 478.313827] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 478.337400] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 478.361498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 478.555154] bridge0: port 2(bridge_slave_1) entered blocking state [ 478.561531] bridge0: port 2(bridge_slave_1) entered forwarding state [ 478.568168] bridge0: port 1(bridge_slave_0) entered blocking state [ 478.574513] bridge0: port 1(bridge_slave_0) entered forwarding state [ 478.582030] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 479.280506] 8021q: adding VLAN 0 to HW filter on device bond0 [ 479.351501] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 479.421987] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 479.428380] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 479.435291] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 479.507298] 8021q: adding VLAN 0 to HW filter on device team0 [ 479.536537] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 14:02:18 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000f2) 14:02:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000c7c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x3d0, 0xd4101) ioctl$IOC_PR_REGISTER(r2, 0x401870c8, &(0x7f00000001c0)={0x81, 0x3}) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:18 executing program 2: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0xb979) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x802, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000001c0)=0x800) sendfile(r1, r0, &(0x7f0000335ff8), 0x2) fstat(r1, &(0x7f0000000240)) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x38d) 14:02:18 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xfffffff5) 14:02:18 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000ff01) [ 480.749473] __ntfs_error: 23 callbacks suppressed [ 480.749483] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:18 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xfffffff6) 14:02:18 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f00000000c0), 0x400000085, 0x0, &(0x7f00000002c0), &(0x7f0000000100), 0x0) 14:02:18 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000065500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:18 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xfffffffe) [ 480.915823] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:18 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x4) [ 480.968256] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 481.071410] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 481.120995] overlayfs: './file0' not a directory [ 481.128378] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:19 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000021) 14:02:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000dc200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:19 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)) chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x3) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:19 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x3000000000000000) 14:02:19 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000150) [ 481.632344] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 481.645166] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000241700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:19 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xf6ffffff00000000) 14:02:19 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x4) 14:02:19 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x412901, 0x0) write$P9_RREAD(r2, &(0x7f00000030c0)={0x100b, 0x75, 0x2, {0x1000, "07e53e390c82ff6f944589de962ab5f35ab4d22c999a0e3df6333ebfaacc6eff976e244ad2d0f505c9bb494d62bdac22d6dbb4e33c3a2cb6b2fe9bf42e03b94b06a5b1e58cc4a70dda31d4b793acf2aaefc23959d2c3e70f42ce9190e0cd2208d3e41f666955e26464cc4cb7b27f4dbfb378aebbf47819985594300294549c2c09e7c9314a523767a74a317ff3d9bacf5ab60b4308b0bbafcf9335f0a426be46a9f27737552445cfaad6b2dbf009f46e28766d853dc819a9b5499393e587ba3dcd9a6c15bfe0dcb48b2ac0b11b80f1e8cc01e6b2151943932874eb462eea1d09182e502b87d2b991c6eb8d10d0ce2663028390113fe2d7c057d18b745a5ac6d3b39d7fdcaedd1c17c887d70e419ed843ef0b213a5e9933b4bc0efdd94ca476799e271c7de6be86b96765e82107b906dc109eb6e2a435e0972118c07bb39ad182a4a415947baf6aac008bb0806c4914cd62c99aa60adad3035ad7c3469e82c1b87e7a480e6af3e5363d55b85aa87f3996adae7080131d1e8a7f73cf494aef5a9189e475ae07c89a38ba9d14a4b3b9f0bd57a3297488295533f7b88b47d32b36fa607a53b995162ae532fa9d2969b02dfa2fdaec7ff7f4617ab68ab10cfeeec9e2211a67790051cdfdf4763e3f8ad9343713150f724d11cb7831e9499f998c5d4dba1cf692b7a6bed38a607c9ca11cd01a5c9750d0f9a719ec58cfd8ebee731cffa0c3fb555ec8b608cb58294be1452af9eb53186637d3949c496819382664d2b75f406233051f4d6f5347f6fb81d35e706fd5f84bc995594cfd6dc5110f283e67f654f10382678fcc264764ca0677a9230091905127bb4396bff61345ae033c1cb3a103a72909496748e3b5597054761c6c50a7e2a97831db697c156227177ed005d2f943510922e846c8c03206f711316c3dc8b1e8347f4d36569243a86d05f7630988b5392f373064cb6f1ff4c5d626bd99d3267d7d266cb3c38a7df78cb800de4e4056d5d959c6460242638b4cae7c5ad0d65cf119ea23912578d39327053e1fdc4759c4847972c262683d79535bb804c660fe4372568d66bf5021c25f62790dd3cea6f53e77c3c30baac9f5e2e144750d49381e78716b515eec0ed29c82f7945768d846138720c6091a34b9174d9fb845f2784c49b275e43f8d25e59edd779fc000801d822720378b7d95df368c40ea866630e55a28e79db1bbbf25cd4b5dc07f6e3f2e43d20c1d970555e486472b27d5dc61405dbe067645bd02fee7cd154388cd8ea02f319841529e1c1b2df38f6fbcb49e7832a04300064374ccd879b6d581d2446153e07fd8e7d6fe8dbd3b68c1fdaf92900c33910727120ea1b57e54a006a83e1963b363c26b1e33fd302365af4ecf5373f364d839164b8c53e6dd3760d07edd258c52a4c0a6c92c8d84e55de14850cf831ab8712a4daa3c68af4ebb325780f5146d58888703e9bad2f05a9254f952c59b57b92d4e7417a9b8bec4025fdd87498aeb7566e2909d77e807d4960da4c9b5e9118cb90a10a9b3c0166507bbafd8a91e0b1c3cd561db2e41b5b9390eef91fa28376e80ef10766b09fb352d04e6dcc5f99c62f340c6fd9d044fc736b0d9e5a512c2df1b7537d02bb9b63ea76b8a08e2818dcd114d6d403ed65d573dea3cd49724fa7c2f050663ad455a95e9e360bf370508fec68b65d14aec76fb794766d3f9ffa5e9a075ec2c8502c9d9ee0ac5a5d99cd9747b75bd81826317d2eaa547e852b64a3e1de0d8ce454a7b012938a892215d95dbaaa1fa48528364184a7529816711a4d988fa52e9729a927b48676afd8affba4a1c3d9a6c9e013ed60c55067efe733bda0b4b1281e1468af038e0944f279ff41eff2f90d8a3f5663a1fd3353a7863740e078b5a63319eee46f37254fe8e3a63844e1b734d22061cce69ce1cae1c1c759883fc26829e8ea42fc70cdc9687389ffb328b9ada6c4eea40ab3b4d1efa3d6b08b4522cd5cf3a87475b8e18b12bb99ae3a5258f6b89430655f6ec5e02552b3303b151da9226ddb3d4f6feeabdf21a4b1ab3ba839c43e4d29a7f704a91a5922df09c784624f61737d3bcf9b6a5013cd1b106387a42100b4af501c3e627e5365ae0eac132c08069302c167373d58882e8e37f707ef4ea733e0b70e5ec470a53fdd9dcb1e56e152bfd1beecc476de3baf224b26fd1517630d5fa3d4617fc8d97324c52444fa90e547f937712fe449761279e9c7769457e116af0a087b0e8c21b04cd57157b1d2b8ad29e9bef52135f04b519cfae5587f0b5834b273bc32481a8f2d5ae9cc5afb5d254d801c14e12c38a74fd1f86e6e0558ee83683c15fa231dff2cc49a6a343922b12ed9f88c297a9e6b3d1ea44f0a4bdd70e1e54ff58ce9b3d4553edb5cf422ca0a90e11a6c50821604870d9122c09d3dc96ece3e690e5e52989cb0ac431efa53f1a009f654c0f8a41f421306275e32945de6e8396de5bb8c31ced263e09a6fcc64af1618bccc9a873036c2e57017196dec06e1753480afa83fe18e986d32b3a440827efd1a5244c1352c46442822f5b8b267763549f416c88a3939a9e9c56544009c40502ebf099670baec110c6d10c25266a38bffa50fbe29f447e7446af8ffa1393284819d14558f7af6e525ecea190a21d14c570b92504de3e142297c72183cbb392384e233cf20f12490964b0f4a8602d083f4d85fe6480493108c727df7f21171810874226fdf1fcd97f4638f96631c0d5c33bfa1df5ba5c44a82142ab1d0191a9fee608ffc1946f6003f149486e13dd2e54e12496f8cb6dff95ca97780b5df9bf7c171e8424bb57a49e9e3d8f80c53cec84474cf649a9745d38451eb18c39fd9c47091552a7c212b6a992e9021c41debf8e21f4db76b4bd09ea284e4ab3b76c01103a25459db2d26c22170f0ddf889839634bb67a03ee3dab667946925ee37019f9a07e3e3aaacc15e0ac629f350b88eb29d026f348f670f4d0473b3d523ddeab9583d2e3c51fb4fc693022ce058379159024254332d46053c174f99eac90e95b335474182890aee5730ef7f77e6e12ca8ec6e55688455461f217b8308820722c4dd7aeac9d01f8b27787d991cf1fa8c700d3a346f3550777f6aad10b98022012e8223fb036c468b1cc98d7c5f7453c54ce7f8efbd47030340fb9c49d2170d42c40186b9993185253e0ea587fae8f1e5862aef610516d62fae731c9507c1f4eff842d2dffc733ed6401f51c2ccfe139556ae3475aa59578e1f8d63293112ee7a3c8b0823d4b4fc6e912be04e437969dfce7f663ae11a776045bc756290d7eede448ee8cab9b3451b38f90be2401e2794e75b1649a2b61e8d5bbdc73ac90979754b5d1442960764e72656725fcab699026b68f06d0fbaea58828a4742af6f5551f39dc3877089716e3831cff20160fe5889d9fdd18abc32e4a3cc84f01bb8370fdba282ef1054a551b33fe3ddf9ac0df6d7d48b94df11b753e620781ed24f868c299462c9af562a76645973b7328acc791cc0d271eee4be60079ee1b0891aad775a3f1bc810ae6b93999c0ad6dfe4e781479c516cf19dc4a5a1b07c9d7a0c6a72fe0a5d4f4024d47e141202a30813df4113a7e4b23ba2378958643a0392e608b373c72e208ee14f67bd3411fa1a6ee5c3c84ec467a08b94f5bb4a936104230561a14057a876a694c15a29957d6ef496b722c95e4d654109189f8ad414b5efe7ec1588a040b5c3d179268a5df90ee6e572576aaadbade1e7f389ab3b2d8b3176ba060dbd4a482ce1bc79f38b153b28e2eb86aef573c6645437d5cc9af5e038628de291bde18c377d80ff79e67850d436f9acee11b76e8763e25626f3c901c796c74f04f2c7f6da518df6e84d587709e0df8e7be895f6e56b668da3f36e7041208fae6402550ae9d305a0f71e59a77a375663b884844c65f48ab5151f0368d717bc5ec2771b3d1118fc1e2f59899f6498ea80383ecc8490ac43e8c122cc332a24fdd337a2f81e723d5442e5d09987e6ab559b7cb6db7781f49063497df40127b1b9d54f085da935b0c2f450c29e59f6189b8c80a15ccf5cc6334466ce9d4f63d48efa05a95ab0a4174927f14da102d9854e8a4a0e5aaa1d51f10699b38f1bfd5121fd5f8e7f90aa40791f69e98e96f51145296c489e64cf9d3778ff662bed1a07377a6f79bf270b8f8d20d1beeb0407cd59d908db50979ac4d93ec6b4bf81ca498246b120b7ced36e8a48d886be7f9ac9f2203f720282e122e4183e3afcb7cc6bd47d41f3691f7853a3985da5f4cf6e99ba59ac359d113dce76d225e72a01de7a1308e6a794e8f1c7a7baa8f308bf66cdef80ea57562cf464ff1c863e2bd915f0b27ee301de22bf0700ad6c786556ff9341cea5b981dcccd234e334a669b4256e0584b734d789e3259e3c6e205dd8f8a9094626bc09fb7deb628370fe4c9ab4691695e9dfe17193cada555719c6b11eb4e836deb7d50cf82d7fbd6204e0870b9d0905b87a9d4bf9750f251883ddfe01c12970b1c73f0b25900bc3b2daedb19c56b2857114bf34f980e7510e6cd51083c139f0d8bcdef030242f1804e674daebe3e2e2895991247913fb539ccfb396673ca0ece18cde99a6c6f82573f611fff644d00fdd89ba3f749d9ce7934366259ab7e27372b5b9cd73a029603343862d31fc8c4c078db1c48ebecdf0c8ae380e48c827011aae062c4ce41ddeae61f4d0463e0cf483a25e208e826be769eeb535c9f57f2e677908c38e2594b4a0caf8a6778f41a5d10ab46bbfd2833bf18e4dd3fb7bc1be094b813d7e6ddaa34b718924e0a507cbcd41e91b0479f981dcfa8db1339ee95ec4a664821de7a39b78134cf0e61c882fd9c6d6473a4c70558e0b8cd732612885bc83e22f3089d858a31c84f5afbb9678791f6064bbf8945c864124e3da27e34336cdd41c0b3cc55e2fabac48f512cb3f9a336d8317794c1065a5f95e602a6e2ce0d3f3ae767a1a85071bdba0f79929f06b611d78ea2fe6621f028d07014b7e3c487bee79dcac168c4dbf30803cc22251fd21ecb54cf0c0fb2f2e478dfa9bd5951768255c8957fd84a578200247cb1ed831d26cd99ac72cf6556cd18f9a485e3c6686353f43729aaa12569681919e62c121c098711721cde26a959a674031d8edeb6e1bf23a26b4b9132b901c5e0e74a865ae348305262873965430ffe2d035f213136eed8003968fc008d3a3a1e61dcc6092c913892e850013ed7a4c8427eb3de96ba3a3297f2fb4fbe7bfb23537e5dfca841dc544ceb64678f0e58daea8f1bd24730aee401e7c054ad2dbd94ce0bdcd13284f67d6e5922c67f65ccafded49a9f76f3055a08736be15462cf4eb793016a77e1fed23859f3308d509dd722109ebc7aa6c4318e5e3993d0cb4195dc3c0ff5107b0e80ac40d14f922dfb45166b30b0ecc121cd96c18c5d194093371dd8e5eeeb88c9e7074bb8a44591e973ee8b7f065006c03a082fca0ec775cd7d46a582bb610c5a9dce05a2ded887c21398411e586db9e0c2130920125e0c2dc53cc7de07bad229aa0f8277d575b29d8e4751f9f466bca717722f4d6d58b24872dffc4b9a47143fd6febeaf06e753e9da911147545696657492de325db1c83e1cbc5ddbc389dc75385acab213339bbab3df6f5ff2b5bc19c331f7201c7f225d622a664ceff0d8e1f584990590fd8941f78364f826387aa6d5f8a711a3fb4e742e7860d2370cda66aa220ecb4b9a21d5f6603feecaa899d40770bde424f9ddab999089972fb281f183bbd3279da61e08e413106f7cd3513bc24d0122cc0a56bc4c71ca00"}}, 0x100b) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x600}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0xffffffffffffff7c) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000033700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 481.931911] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 481.945463] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:19 executing program 2 (fault-call:9 fault-nth:0): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000007b700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 482.020597] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 482.055905] overlayfs: './file0' not a directory [ 482.228904] FAULT_INJECTION: forcing a failure. [ 482.228904] name failslab, interval 1, probability 0, space 0, times 0 [ 482.259279] CPU: 1 PID: 26521 Comm: syz-executor2 Not tainted 4.19.0-rc6+ #43 [ 482.266585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 482.275942] Call Trace: [ 482.278572] dump_stack+0x1c4/0x2b4 [ 482.282224] ? dump_stack_print_info.cold.2+0x52/0x52 [ 482.287440] ? usercopy_warn+0x110/0x110 [ 482.291518] should_fail.cold.4+0xa/0x17 [ 482.295580] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 482.300698] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 482.306513] ? pid_task+0x115/0x200 [ 482.310170] ? find_vpid+0xf0/0xf0 [ 482.313721] ? __f_unlock_pos+0x19/0x20 [ 482.317703] ? lock_downgrade+0x900/0x900 [ 482.321871] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 482.327396] ? proc_fail_nth_write+0x9e/0x210 [ 482.331879] ? proc_cwd_link+0x1d0/0x1d0 [ 482.335933] ? fs_reclaim_acquire+0x20/0x20 [ 482.340239] ? lock_downgrade+0x900/0x900 [ 482.344386] ? ___might_sleep+0x1ed/0x300 [ 482.348521] ? arch_local_save_flags+0x40/0x40 [ 482.353099] ? lock_release+0x970/0x970 [ 482.357079] __should_failslab+0x124/0x180 [ 482.361304] should_failslab+0x9/0x14 [ 482.365097] kmem_cache_alloc+0x2be/0x730 [ 482.369261] ? check_preemption_disabled+0x48/0x200 [ 482.374265] getname_flags+0xd0/0x5a0 [ 482.378052] user_path_at_empty+0x2d/0x50 [ 482.382188] do_sys_truncate+0xb0/0x190 [ 482.386165] ? vfs_truncate+0x840/0x840 [ 482.390152] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 482.395529] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 482.400997] __x64_sys_truncate+0x54/0x80 [ 482.405168] do_syscall_64+0x1b9/0x820 [ 482.409059] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 482.414407] ? syscall_return_slowpath+0x5e0/0x5e0 [ 482.419321] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 482.424153] ? trace_hardirqs_on_caller+0x310/0x310 [ 482.429162] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 482.434165] ? prepare_exit_to_usermode+0x291/0x3b0 [ 482.439178] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 482.444008] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 482.449180] RIP: 0033:0x457579 [ 482.452357] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 482.471248] RSP: 002b:00007f91b49a1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c 14:02:20 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000fe00) 14:02:20 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x8cffffff) 14:02:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001a9b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:20 executing program 2 (fault-call:9 fault-nth:1): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 482.478953] RAX: ffffffffffffffda RBX: 00007f91b49a1c90 RCX: 0000000000457579 [ 482.486214] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 482.493485] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 482.500748] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f91b49a26d4 [ 482.508005] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000005 14:02:20 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20008700) [ 482.631217] FAULT_INJECTION: forcing a failure. [ 482.631217] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 482.643066] CPU: 0 PID: 26543 Comm: syz-executor2 Not tainted 4.19.0-rc6+ #43 [ 482.650346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 482.659708] Call Trace: [ 482.662315] dump_stack+0x1c4/0x2b4 [ 482.665968] ? dump_stack_print_info.cold.2+0x52/0x52 [ 482.671175] should_fail.cold.4+0xa/0x17 [ 482.675245] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 482.680351] ? lock_acquire+0x1ed/0x520 [ 482.684326] ? __fdget_pos+0x1bb/0x200 [ 482.688228] ? mark_held_locks+0x130/0x130 [ 482.692481] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 482.698021] ? _kstrtoull+0x188/0x250 [ 482.701825] ? _parse_integer+0x180/0x180 [ 482.705987] ? lock_release+0x970/0x970 [ 482.709962] ? arch_local_save_flags+0x40/0x40 [ 482.714553] ? usercopy_warn+0x110/0x110 [ 482.718621] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 482.724156] ? should_fail+0x22d/0xd01 [ 482.728044] ? get_pid_task+0xd6/0x1a0 [ 482.731934] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 482.737040] __alloc_pages_nodemask+0x34b/0xde0 [ 482.741708] ? pid_task+0x115/0x200 [ 482.745331] ? find_vpid+0xf0/0xf0 [ 482.748888] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 482.753908] ? __f_unlock_pos+0x19/0x20 [ 482.757898] ? lock_downgrade+0x900/0x900 [ 482.762060] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 482.767603] ? proc_fail_nth_write+0x9e/0x210 [ 482.772102] ? fs_reclaim_acquire+0x20/0x20 [ 482.776424] ? lock_downgrade+0x900/0x900 [ 482.780577] ? ___might_sleep+0x1ed/0x300 [ 482.784730] ? trace_hardirqs_off+0xb8/0x310 [ 482.789144] cache_grow_begin+0x91/0x8c0 [ 482.793206] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 482.798746] ? check_preemption_disabled+0x48/0x200 [ 482.803790] kmem_cache_alloc+0x665/0x730 [ 482.807941] ? check_preemption_disabled+0x48/0x200 [ 482.812962] getname_flags+0xd0/0x5a0 [ 482.816765] user_path_at_empty+0x2d/0x50 [ 482.820917] do_sys_truncate+0xb0/0x190 [ 482.824895] ? vfs_truncate+0x840/0x840 [ 482.828880] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 482.834244] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 482.839696] __x64_sys_truncate+0x54/0x80 [ 482.843843] do_syscall_64+0x1b9/0x820 [ 482.847742] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 482.853109] ? syscall_return_slowpath+0x5e0/0x5e0 [ 482.858538] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 482.863382] ? trace_hardirqs_on_caller+0x310/0x310 [ 482.868404] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 482.873421] ? prepare_exit_to_usermode+0x291/0x3b0 [ 482.878440] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 482.883289] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 482.888474] RIP: 0033:0x457579 [ 482.891668] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 482.910566] RSP: 002b:00007f91b49a1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 482.918271] RAX: ffffffffffffffda RBX: 00007f91b49a1c90 RCX: 0000000000457579 14:02:20 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x10) [ 482.925536] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 482.932810] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 482.940076] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f91b49a26d4 [ 482.947339] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000005 14:02:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000f6e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="fbff"]) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="28000000030000000000000000e7ff0001000000000000757365725f696400"], 0xffffffffffffffa9) read$FUSE(r2, &(0x7f00000020c0), 0x1000) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$UI_SET_KEYBIT(r3, 0x40045565, 0xb3) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) ioctl$PIO_UNISCRNMAP(r4, 0x4b6a, &(0x7f00000030c0)="8cfdde28df6a1ed42df8a98a7ce1297affd7c372a44a0cdcdc5922c172032187782cc21d44207b8589c956642f865cabcd27a1fb666f4db29807a4705b80d5538a0f09af688504dd52f7a30be18d126041e9c6a5bf3b251ddb6f5e84544f5c1909eff3927b7f23c15837d77ca287385c32630545df16911d3da0bbe1b08463e8e41d79091852f764cef3109a1a7bd1976ac3a8ec951f5c767d145e9b72268a39a7020087b124cf9166b5afa0def37d5808115571a0b58098b83e4517f1a55a18b9bcd41487efc844677f68c84f31922681492598d3b1f15326491f1913f0a49691b4e2fc759c4cb74156ea8c6f0c255e0c5a363be816191ca79fc7512c13c3efa5057efbf34376b62d97420ad81ad43d20825e1d17aa13b8a93468666ea1da062699684d09d4fd8dcd6014f6e810a93f905d40d28dc0f3cdc04b175787fc90b3681a996b60395612a5326afd38423d847920ed0a565bb32a4e838053a70bef1202a3ef5437f5544db13ea8ced51086f3ffea241dfc85fa6d6b7c950e46215919e7c199c3a5cf8dcb2ced6fdd9dc37b3ad4bba010226ddb07ff8e1df867e9d3466e8503ddc1ab3a91ccd19ea0311662fce593fac34965216a9addb55700b363cdc50bd3139504125f3f90ceb71ccd5cb255fbf61f511894114580220e2334fec7871de54f8d8d86ee40926ed84b9a4f34b71c1a6c85f2c32b672385d822742b5d216cb39766ea6ae3cfe05d10fb7b8d63065cb1aa3a5b34bdc32b34606963e16b8349f71d59aeb799a6cb273c8be3d52cbebbc214a8e8355ff3c0ca901ebddc0df2674d30b42fc0bd9c6a668620282e67b9033ba5d53b004332a23f3837538cca825849cd74742fe022f70dfd34d186efeac616949f43d131a7d4001ad2f697ff20c208683e770a8337c1e1c595a3cd274088bdff32f38226d2d05eca5e7216064add6a0995264a2effa299fe8579491430352ac219e6c816002b56f3f08d2f6bebd82675436d2679a1725958df390f9630ca50b229272250fffa727f3b7fb540cfcf050e72487c6205551b3c89f5cb688b2f0a7a6ee90403039f2ee1ffd6d3f736b7a3cb90558429e117c463cb9fcd336f77de534ce782232115f84eb55693471fdb71389903a09c3c2cf38492fb8963b5a8e1cbce4a02dde2c5e43b2d307966e1a0b837b0f49f77b6de4c3a9d431be86829a33647ce4c685c63bb939ae418d46c37fe2fe84bf12dda75ad18530c91ad4de1766077882dd8158a5e7c9e0fd7ac8852131f699dd19e91bbcae92a7c36275d609596283144cbce4e1969c125563541daf41d38880628583dce960d9cf7902637e7c064495198b180f6410a758c4bb8208a62b76d347a55a8fa2b0376802f560ff622fa3ddb91f636819f7a3952f757c98ef682b7f24f3d6ed80f42b7ba8afb70df277c4d507cf1224d82255d3b3aee8e0ccb26a97bd1d5a13f5ff761d2b88a317bed31b2bf1f06976ec4172f6c923e428b74585f46c2b4f0cd141b1208e84316fac2512d15e51d5f3a17b890c211809af76f595539426f509d30d57d653083fb0c3d2a7320079a3bb66eaec8a13d551bc10a20b1b21c48ba74b60f27471f301de1388b1d08b5590fd6167b347714f644fecf0f2e21d3a33cc7e95f733b96684b67bb089efcc55f5c4ce9a7078a298eab914ac6e9efe13535d53992ef8d0f387d7fc95838cc39ca987505ea9a667ae86f045c3494297390bf7d2a1290647611ceb429a6899fdb4e55c3cc229a76a1f25e77349a04c01253d8fc16434760937f14c8c1ea04ddc5209c39378258bd04686579754ec67b4f1f8b21d3fc6f726c6f195025b2eebf7bfd2b942fec27cdbd91b1a6be5b572b60925fef4efd27c59d5d8ff4b59c7baf46bd266f0893d153d8b848256c0bcd901a3a389bc40c83f94e418a1466595d583ce29d329d06a9749be727c79d93af9d011e5e9f820e7cfb10b5346f0df1a3d4d4324008290da26f67faa2567b3c2cb945e24d93681105972cbcd710cd1a110b03998878f41ad9da1c36208218b0a815b3a3ab96ea2cc3eff25232e1d81812514c44f1c86f1daac3f94737ad67144a66a7ae77b0c8117b47b35b5ed07ce4626c3ffeee3b1b3aea3dedc925ee1ec777283097193eee4958c1d30287f5a066ded08f606c41be3b9a7da26d7432004af02c3602ee3247d379e8e43b5025debe9f5f2dcf15cc2b4888bb2a8cf97b0893e7691424f75698a66d5723cc87d3a0fb36e9229713ff6a87501e1d66ec85776c8ecaecb49635b1c04e5b4e48976fa1ba5c4a823c88bbc12248bee7dc4e563a0fd42f2ede21fc29fed861ffcc6214f84f52cfa3988d23b6b17a0f3a5240a8c86d376688c5ff54243c158bb27df565a7a95112d6a41d644bf8d41718c6b447692254547b5437b94e717f095d18435ead8bd0afb0ee5a1a45b2ce00450e143c0289cb2f9906b8a8d89764caf417287038841d00bfb6848e2cfd89903ef85a2edfaa0535107cc5d89b8f7580a53831e1f6bdc43d878ce402e6f5d381507e93d1bb8955bf05c436a5d3adc8a9b61fec3d8a391629f7ce78f31ce239f3d15340ac5a72e813efec4d40debcacffcdf94123229132c2b869e8c479321c0e498244bc6da5bb483cfb942943b1e7e49e322ead6f7b4954ea88eeceb70a7e52c3b4c20cbe6736ac690d5e5bb73094b42d002c740929cf502c597351e951cc96f2b0732170507ab3610388db20dd77186dc946f644441c7d23af3408e8f68fee43faa2627175396b4c0f40e271cff22258a3db1ba0c77b91361886d4bff7e61bf184dfe0f15d28d2ce0f8edd28c1aedeb6797e212da55ea061da0fe2b57a06ccc5976da4ac643e63e20c49eda03195b54c15082749f1b609cf99f4b9f2746992b6c5bb49919ed377e03223ce2fa9e5c5d483606beacedba104f68da5c27e71c2f1edcd5452d59fbdd86f7f4105982aed4f2f24bc91bcdf2711dd28687ac9f999c9f2e85feb9ab9635ad1a8d70ed1f4f010d077e4224c754aa9a93c5265dd2f895212642ff860a87f56d9bb36a131f3628e13daa0ca5ec7637c7ed989a440ecbf40277c3507f093e37424b00bf756a8ef637a83141ca63a9d4b7502f26371fc947e594ebd62d30e0932bae5e6c83651dd36db6a431ccdbfbba8d5ca0104ba8dd9ffa6f9162b74f6a96f5815b0d39859e5e85499d82f442ccc6a5c32458ea3d0e830f722468f650be765612f331fcb06b849bbfc144dfd761407ff7195e67449ad7c015c714a9d45325d0652432b727ec7abfa2468d5624e83663b4c6881fdaa2bd4e8bf62f4b6fd74a8bd9f653d274966d9195d05d86fd55e735dfdab3e8e2868e5a95d036796f2f0a3d6b6c4f8f0499ed2fad3de1cb0d741f03ed48fcde152446fa4a2336d780b7b0fe04e10002d86e5a93f4fee680e8aa04ecfccd818db25c4b6cec03512b371b650c9beb8455140b9b9814b9ec63ab24b4d5de9293e1465f271a737f1b9d8ef7798df9e45a44a569ac6ad07be39ac28f99221889cf147891592f9e728ab527929c907318232996ebbda2b1a023ffac42302e2a9fe019f2f4c955b750928aaf78ecff238532305bb3db177ed678aabe32f969a691729aeb94ab3ec1d6e8a8769c32447e1e364d897a150581dfd39c52e7c4ae3da123a118e6f4c8ada16c6fd341d92f518752a2fdb60a5520aed0753565f4fb7a054e043f30ffe46be0a6a16d2b86bbd4a9dddd444757eedd0a6f41da0c1899890a839628200648d44657df027b874130c0438b2a727c7cf0f8c01481a10729c85118f72f078d37693a2c408cc620fcd10d27143c874f4da8b51f2f2da8394793238813feb09aca1e13638809d0c1df634f7fa320475c2e98b593d2f239920d5310322d3d4a8ad2addff1fe22c7ed24d572acee5a917296c99b28772b6f5a7a290d5c31f58afe3576122f3d2dd3948b3eea155aa8e92c6196f92b062474204d2e49bc51f9a399700354f3b99b416e97b81324d7b8cf0251d30393b4a431299ef49e69df2b196474a6e4871306f9dd56093adab94f676c4e562095af3ca9e79c53aa718fb170c57c7989953133abcc07eeabf1fe7fc3dcafa5b0b07e02bdab8dd5230122681c177db5f1a443a4ffdc8dcdbbc1bb72a2dfa88f519c7cc748ef3c17c8d01e2dd7b0f87310442ffbdc2cd1102c338d8d8c991307c6c11996640bf0d784f6099abae1d52ddf2e8e4e27d5a4a3d2a29cbddbd047f80fee610c18e4bf18501d94d777419651cf9d249ab32796ee63231a9b97ee8fd19460ea9827a4e9f267005f3a95fe6e9a1ac65f92906bf665bd62603d812312ef6275ca51e2b9731dc2cb6ba9c0039fd0a296a9fdae022a21888e61bba60e79ebf6ffb6393473772187379d7901ee90d46db8cb5730c19ca727c7f0cae8cc2624dae42365372807f5f954cdae08cd239ef8bb452819a91b1185dadd338c983442f23453643d1572a95136dd931af29e769e69371a44f229ac0b708aac7d21994d898e072b79ae1a2ee16cea92776b8d49fbc17fce907830c36a7bddd4382cd1a753957995f0d796e66e2062ce7d70f503be682e452d2fd0aaa5623a50f2a9cedf9d21088a66c16eaf3768dabcb424a48e5fdee0ec836a158f5bdb480753f4329f11e41ec591ecfff8075a421218cf57b9fdd4eda0c92475e7197b4ce679e39723b939f407cbd7ff19fdd15110c85b312642fa8f9b23b21cb29d75ebb305feac45748598d39fab654a63b5cbbc3678bc59ede5127e266958f9ce65823efba8b83c0cd4e42aa1aafaaa0359bd8bb91e323844081206f9c256e20b43fdb6ca6a541cc9feefb94856c764cdd7c470dd0cab9946abcf94d2c4cd85de38ffac957cd5921a430d6843d3e6c805ea9ba410f1d87dc49c94f108cfb745099aac520eb5c1bdef9afe19a62ccbdb34ea2d5e99a4a66b3c84c91561f8b642d86ca0269b1d16b5b42c7aebf0aaf503abd7ca5668705fb083d0d60866e48f1a70e2eb7d9c6ca4061acca629cbbf71ee6f7a092fc84c6742d341dffae272fd1c2b84d7debb3bd71e8b177b51acc9fc0aed231607d84f11764247881bed608bd1cc8a8f3cf110533104b3f6a88fe2da6cd0225d52f4ac406be299104c0b2699c86d8e51539ab64a40bac88d4a23005bb00a2d90282d5a42c3026c7774969810a80c63874eaedc0d94be0e69f4c06cd029ad66edcdca5a4b06b363fc8dcb72885ff33f836a8f56e892890ce4f41849f654bd6ba1f18b3651335ad59a3e29d07b1e8006a584704716b361f7f1cc1900b5b0a9d738a51f2254ba6924b317b2c14e41b6122db9e6ddf7989f8ff8f62ad4a21789b5ffbb293993b51efb46bfee2a47007436744787f1bdd94e9b0c4fb6711360775b8562e929a6afc78a8b36920c82dc5a3d4e315ca9e3cad84ce7d0c279596b4c8e53554fb04f8586b96c98718d64a17d277418a1972eaea74ac1fedd4c1fb33a97474351959ea31ff5907a02956236482839a147273b625ff15eb228fb2e9112bf907a12f27038259869566ea8f7752b47141a0bc47dfc0cf664335c95b20e796d845f99eff2508f4da99db6dd2f6d9f8919f3bc66afcf8c4c478c2920bcec05beebc9e33ba0c6879b7b0b5d6143b4ba4faa9daa33625e183ef04be9147a7e684d826ea2a27f6abb740efb8e7ff2b0f4a79df31f734f1eb948ee0b7e8a260c298a930ab692673e446f24dbcaf85a704079528527fedbadf82c538a93d4e25ceb1fea9549607f8275d39c050f6dc62d0b23ad8428aad7963ab59431635de7c7c6778be7d5f30") socket$inet6_tcp(0xa, 0x1, 0x0) lstat(&(0x7f00000009c0)='./file0\x00', &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r3, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r4, &(0x7f0000000500)={0x90, 0xffffffffffffffda, 0x5, {0x0, 0x3, 0x8, 0x8, 0xd81d, 0x5, {0x5, 0x4, 0x8, 0xb65, 0xff800000000000, 0x5, 0x400, 0x9, 0x10001, 0x80000000, 0x3, r5, r6, 0x5, 0x200}}}, 0x90) read$FUSE(r2, &(0x7f0000001000), 0x1000) [ 483.112685] overlayfs: './file0' not a directory 14:02:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000a7b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:20 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xf6ffffff) 14:02:20 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000040c0), 0xf1) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 483.172817] IPVS: ftp: loaded support on port[0] = 21 14:02:20 executing program 2 (fault-call:9 fault-nth:2): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 483.253914] device bridge_slave_1 left promiscuous mode [ 483.266409] bridge0: port 2(bridge_slave_1) entered disabled state [ 483.273663] device bridge_slave_0 left promiscuous mode [ 483.289700] bridge0: port 1(bridge_slave_0) entered disabled state 14:02:21 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000b900) [ 483.364615] team0 (unregistering): Port device team_slave_1 removed [ 483.374998] team0 (unregistering): Port device team_slave_0 removed [ 483.385411] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 483.397756] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 483.432909] bond0 (unregistering): Released all slaves [ 483.450515] FAULT_INJECTION: forcing a failure. [ 483.450515] name failslab, interval 1, probability 0, space 0, times 0 [ 483.485914] CPU: 1 PID: 26596 Comm: syz-executor2 Not tainted 4.19.0-rc6+ #43 [ 483.493205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 483.502557] Call Trace: [ 483.505158] dump_stack+0x1c4/0x2b4 [ 483.508808] ? dump_stack_print_info.cold.2+0x52/0x52 [ 483.514030] ? trace_hardirqs_off+0xb8/0x310 [ 483.518470] should_fail.cold.4+0xa/0x17 [ 483.522569] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 483.527701] ? jbd2_journal_stop+0x430/0x15d0 [ 483.532198] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 483.537650] ? __kasan_slab_free+0x119/0x150 [ 483.542064] ? kmem_cache_free+0x21a/0x290 [ 483.546298] ? jbd2_journal_stop+0x234/0x15d0 [ 483.550794] ? up_write+0x7b/0x220 [ 483.554331] ? up_read+0x110/0x110 [ 483.557889] ? fs_reclaim_acquire+0x20/0x20 [ 483.562218] ? lock_downgrade+0x900/0x900 [ 483.566373] ? ___might_sleep+0x1ed/0x300 [ 483.570523] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 483.576061] ? arch_local_save_flags+0x40/0x40 [ 483.580643] ? creds_are_invalid+0x140/0x140 [ 483.585054] __should_failslab+0x124/0x180 [ 483.589286] should_failslab+0x9/0x14 [ 483.593087] kmem_cache_alloc+0x2be/0x730 [ 483.597235] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 483.602945] prepare_creds+0xab/0x4d0 [ 483.606745] ? abort_creds+0x2a0/0x2a0 [ 483.610628] ? __ext4_journal_stop+0x106/0x1f0 [ 483.615210] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 483.620858] ? ext4_xattr_set+0x335/0x420 [ 483.625030] smack_inode_copy_up+0x145/0x1b0 [ 483.629446] security_inode_copy_up+0x54/0xb0 [ 483.633994] ovl_copy_up_locked+0x335/0x1810 [ 483.638410] ? __sanitizer_cov_trace_cmp1+0x17/0x20 [ 483.643427] ? ovl_set_origin+0x130/0x130 [ 483.647576] ? fsnotify_first_mark+0x350/0x350 [ 483.652162] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 483.657696] ? evm_inode_post_setxattr+0x39/0x130 [ 483.662540] ? up_write+0x7b/0x220 [ 483.666075] ? up_read+0x110/0x110 [ 483.669616] ? __vfs_setxattr_noperm+0x19b/0x410 [ 483.674461] ? vfs_setxattr+0x70/0x100 [ 483.678355] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 483.683915] ? ovl_check_setxattr+0xc5/0x130 [ 483.688330] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 483.693878] ovl_copy_up_one+0x1429/0x1970 [ 483.698117] ? ovl_copy_up_locked+0x1810/0x1810 [ 483.702785] ? dput.part.26+0x241/0x790 [ 483.706759] ? lock_downgrade+0x900/0x900 [ 483.710917] ? lockref_get_not_zero+0x70/0x90 [ 483.715409] ? dget_parent+0x1a5/0x6a0 [ 483.719296] ? lock_downgrade+0x900/0x900 [ 483.723444] ? kasan_check_read+0x11/0x20 [ 483.727621] ovl_copy_up_flags+0x14e/0x1d0 [ 483.731869] ovl_copy_up_with_data+0x1a/0x20 [ 483.736276] ovl_setattr+0x22f/0xaf0 [ 483.740017] ? smk_curacc+0x7f/0xa0 [ 483.743645] ? ovl_fill_inode+0x6f0/0x6f0 [ 483.747791] ? smack_inode_rename+0x370/0x370 [ 483.752284] ? lock_acquire+0x1ed/0x520 [ 483.756257] ? current_time+0x131/0x1b0 [ 483.760239] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 483.765777] ? evm_inode_setattr+0x6f/0x170 [ 483.770103] ? ovl_fill_inode+0x6f0/0x6f0 [ 483.774251] notify_change+0xbde/0x1110 [ 483.778229] ? setattr_prepare+0x830/0x830 [ 483.782464] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 483.787999] ? dentry_needs_remove_privs.part.25+0x54/0x70 [ 483.793626] do_truncate+0x1bd/0x2d0 [ 483.797337] ? file_open_root+0x580/0x580 [ 483.801485] ? inode_permission+0xb2/0x560 [ 483.805722] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 483.811259] vfs_truncate+0x60e/0x840 [ 483.815063] ? do_truncate+0x2d0/0x2d0 [ 483.818981] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 483.824517] ? getname_flags+0x26e/0x5a0 [ 483.828581] do_sys_truncate+0x156/0x190 [ 483.832639] ? vfs_truncate+0x840/0x840 [ 483.836613] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 483.841980] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 483.847433] __x64_sys_truncate+0x54/0x80 [ 483.851585] do_syscall_64+0x1b9/0x820 [ 483.855468] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 483.860832] ? syscall_return_slowpath+0x5e0/0x5e0 [ 483.865814] ? trace_hardirqs_on_caller+0x310/0x310 [ 483.870830] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 483.875877] ? recalc_sigpending_tsk+0x180/0x180 [ 483.880635] ? kasan_check_write+0x14/0x20 [ 483.884884] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 483.889736] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 483.894922] RIP: 0033:0x457579 [ 483.898120] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 483.917014] RSP: 002b:00007f91b4980c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 483.924722] RAX: ffffffffffffffda RBX: 00007f91b4980c90 RCX: 0000000000457579 14:02:21 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000025900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:21 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x4000000) [ 483.931986] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 483.939252] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 483.946516] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f91b49816d4 [ 483.953779] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000005 14:02:21 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000155600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 484.094080] overlayfs: './file0' not a directory [ 484.700752] bridge0: port 1(bridge_slave_0) entered blocking state [ 484.707455] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.714254] device bridge_slave_0 entered promiscuous mode [ 484.736609] bridge0: port 2(bridge_slave_1) entered blocking state [ 484.742974] bridge0: port 2(bridge_slave_1) entered disabled state [ 484.750162] device bridge_slave_1 entered promiscuous mode [ 484.772536] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 484.795574] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 484.860224] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 484.885150] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 484.978025] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 484.985092] team0: Port device team_slave_0 added [ 485.006348] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 485.013401] team0: Port device team_slave_1 added [ 485.035514] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 485.042478] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 485.050358] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 485.072046] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 485.078943] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 485.087146] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 485.105935] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 485.113008] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 485.121423] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 485.141101] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 485.148127] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 485.155926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 485.351954] bridge0: port 2(bridge_slave_1) entered blocking state [ 485.358326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 485.364892] bridge0: port 1(bridge_slave_0) entered blocking state [ 485.371268] bridge0: port 1(bridge_slave_0) entered forwarding state [ 485.378543] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 486.006370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 486.092846] 8021q: adding VLAN 0 to HW filter on device bond0 [ 486.161412] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 486.230809] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 486.236987] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 486.243890] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 486.314624] 8021q: adding VLAN 0 to HW filter on device team0 14:02:25 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000f500) 14:02:25 executing program 2 (fault-call:9 fault-nth:3): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:25 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000480)={0x50, 0x0, 0x7, {0x7, 0x1b, 0x1, 0x8, 0x0, 0x0, 0x2, 0x1}}, 0x50) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:25 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x4000000000000) 14:02:25 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000061d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:25 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000027) [ 487.558475] __ntfs_error: 8 callbacks suppressed [ 487.558486] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 487.592027] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:25 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001a6d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 487.624210] FAULT_INJECTION: forcing a failure. [ 487.624210] name failslab, interval 1, probability 0, space 0, times 0 [ 487.636942] CPU: 1 PID: 26905 Comm: syz-executor2 Not tainted 4.19.0-rc6+ #43 [ 487.644237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 487.653589] Call Trace: [ 487.653616] dump_stack+0x1c4/0x2b4 [ 487.653640] ? dump_stack_print_info.cold.2+0x52/0x52 [ 487.653666] should_fail.cold.4+0xa/0x17 [ 487.669097] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 487.669117] ? jbd2_journal_stop+0x430/0x15d0 [ 487.678710] ? trace_hardirqs_on+0xb4/0x310 [ 487.678729] ? kmem_cache_free+0xb0/0x290 [ 487.678748] ? kmem_cache_free+0x21a/0x290 [ 487.687201] ? jbd2_journal_stop+0x234/0x15d0 [ 487.687217] ? up_write+0x7b/0x220 [ 487.687229] ? up_read+0x110/0x110 [ 487.687249] ? fs_reclaim_acquire+0x20/0x20 [ 487.687265] ? lock_downgrade+0x900/0x900 [ 487.687285] ? ___might_sleep+0x1ed/0x300 [ 487.715646] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 487.721189] ? arch_local_save_flags+0x40/0x40 [ 487.725777] ? creds_are_invalid+0x140/0x140 [ 487.730192] __should_failslab+0x124/0x180 [ 487.734426] should_failslab+0x9/0x14 [ 487.738228] kmem_cache_alloc+0x2be/0x730 [ 487.742387] ? ext4_journal_abort_handle.isra.4+0x260/0x260 [ 487.748106] prepare_creds+0xab/0x4d0 [ 487.751909] ? abort_creds+0x2a0/0x2a0 [ 487.755802] ? __ext4_journal_stop+0x106/0x1f0 [ 487.760394] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 487.765944] ? ext4_xattr_set+0x335/0x420 [ 487.770107] smack_inode_copy_up+0x145/0x1b0 [ 487.774515] security_inode_copy_up+0x54/0xb0 [ 487.779017] ovl_copy_up_locked+0x335/0x1810 [ 487.783423] ? __sanitizer_cov_trace_cmp1+0x17/0x20 [ 487.788442] ? ovl_set_origin+0x130/0x130 [ 487.792600] ? fsnotify_first_mark+0x350/0x350 [ 487.797182] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 487.802718] ? evm_inode_post_setxattr+0x39/0x130 [ 487.807558] ? up_write+0x7b/0x220 [ 487.811095] ? up_read+0x110/0x110 [ 487.814634] ? __vfs_setxattr_noperm+0x19b/0x410 [ 487.819395] ? vfs_setxattr+0x70/0x100 [ 487.823289] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 487.828826] ? ovl_check_setxattr+0xc5/0x130 [ 487.833243] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 487.838786] ovl_copy_up_one+0x1429/0x1970 [ 487.843043] ? ovl_copy_up_locked+0x1810/0x1810 [ 487.847714] ? dput.part.26+0x241/0x790 [ 487.851687] ? lock_downgrade+0x900/0x900 [ 487.855839] ? lockref_get_not_zero+0x70/0x90 [ 487.860341] ? dget_parent+0x1a5/0x6a0 [ 487.864232] ? lock_downgrade+0x900/0x900 [ 487.868387] ? kasan_check_read+0x11/0x20 [ 487.872564] ovl_copy_up_flags+0x14e/0x1d0 [ 487.876818] ovl_copy_up_with_data+0x1a/0x20 [ 487.881224] ovl_setattr+0x22f/0xaf0 [ 487.884935] ? smk_curacc+0x7f/0xa0 [ 487.888560] ? ovl_fill_inode+0x6f0/0x6f0 [ 487.892705] ? smack_inode_rename+0x370/0x370 [ 487.897205] ? lock_acquire+0x1ed/0x520 [ 487.901179] ? current_time+0x131/0x1b0 [ 487.905156] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 487.910693] ? evm_inode_setattr+0x6f/0x170 [ 487.915017] ? ovl_fill_inode+0x6f0/0x6f0 [ 487.919163] notify_change+0xbde/0x1110 [ 487.923140] ? setattr_prepare+0x830/0x830 [ 487.927387] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 487.932925] ? dentry_needs_remove_privs.part.25+0x54/0x70 [ 487.938550] do_truncate+0x1bd/0x2d0 [ 487.942265] ? file_open_root+0x580/0x580 [ 487.946409] ? inode_permission+0xb2/0x560 [ 487.950648] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 487.956186] vfs_truncate+0x60e/0x840 [ 487.959990] ? do_truncate+0x2d0/0x2d0 [ 487.963885] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 487.969971] ? getname_flags+0x26e/0x5a0 [ 487.974042] do_sys_truncate+0x156/0x190 [ 487.978101] ? vfs_truncate+0x840/0x840 [ 487.982074] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 487.987443] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 487.992911] __x64_sys_truncate+0x54/0x80 [ 487.997061] do_syscall_64+0x1b9/0x820 [ 488.000948] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 488.006327] ? syscall_return_slowpath+0x5e0/0x5e0 [ 488.011287] ? trace_hardirqs_on_caller+0x310/0x310 [ 488.016331] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 488.021351] ? recalc_sigpending_tsk+0x180/0x180 [ 488.026118] ? kasan_check_write+0x14/0x20 [ 488.030363] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 488.035223] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 488.040416] RIP: 0033:0x457579 [ 488.043619] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 488.062526] RSP: 002b:00007f91b4980c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c 14:02:25 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xffffffff00000000) [ 488.070243] RAX: ffffffffffffffda RBX: 00007f91b4980c90 RCX: 0000000000457579 [ 488.077519] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 488.084791] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 488.092064] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f91b49816d4 [ 488.099336] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000007 14:02:25 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000230400637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:25 executing program 2 (fault-call:9 fault-nth:4): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 488.262648] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:26 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000e2600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 488.304291] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 488.343799] FAULT_INJECTION: forcing a failure. [ 488.343799] name failslab, interval 1, probability 0, space 0, times 0 [ 488.347037] overlayfs: './file0' not a directory [ 488.377951] CPU: 0 PID: 26925 Comm: syz-executor2 Not tainted 4.19.0-rc6+ #43 [ 488.385277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 488.394642] Call Trace: [ 488.397242] dump_stack+0x1c4/0x2b4 [ 488.400906] ? dump_stack_print_info.cold.2+0x52/0x52 [ 488.406109] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 488.411397] ? rcu_bh_qs+0xc0/0xc0 [ 488.414958] should_fail.cold.4+0xa/0x17 [ 488.419040] ? fault_create_debugfs_attr+0x1f0/0x1f0 14:02:26 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000b1) [ 488.424159] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 488.429196] ? bpf_prog_kallsyms_find+0xde/0x4a0 [ 488.433985] ? modules_open+0xa0/0xa0 [ 488.437807] ? is_bpf_text_address+0xac/0x170 [ 488.442310] ? lock_downgrade+0x900/0x900 [ 488.442331] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 488.442351] ? fs_reclaim_acquire+0x20/0x20 [ 488.456620] ? lock_downgrade+0x900/0x900 [ 488.460789] ? ___might_sleep+0x1ed/0x300 [ 488.464953] ? is_bpf_text_address+0xd3/0x170 [ 488.469458] ? arch_local_save_flags+0x40/0x40 [ 488.474049] ? kernel_text_address+0x79/0xf0 [ 488.478480] ? unwind_get_return_address+0x61/0xa0 [ 488.483423] __should_failslab+0x124/0x180 [ 488.487663] should_failslab+0x9/0x14 [ 488.491481] kmem_cache_alloc_trace+0x2d7/0x750 [ 488.496163] ? save_stack+0xa9/0xd0 [ 488.499808] new_task_smack+0xef/0x310 [ 488.503711] ? smack_sb_kern_mount+0x410/0x410 [ 488.508300] ? ovl_copy_up_flags+0x14e/0x1d0 [ 488.512717] ? ovl_copy_up_with_data+0x1a/0x20 [ 488.517318] ? ovl_setattr+0x22f/0xaf0 [ 488.521229] ? notify_change+0xbde/0x1110 [ 488.525391] ? do_truncate+0x1bd/0x2d0 [ 488.529293] ? vfs_truncate+0x60e/0x840 [ 488.533275] ? do_sys_truncate+0x156/0x190 [ 488.537509] ? __x64_sys_truncate+0x54/0x80 [ 488.541838] ? do_syscall_64+0x1b9/0x820 [ 488.545921] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 488.551331] ? lock_downgrade+0x900/0x900 [ 488.555502] smack_cred_prepare+0x109/0x910 [ 488.559921] ? mem_cgroup_handle_over_high+0x130/0x130 [ 488.565209] ? smack_cred_alloc_blank+0x70/0x70 [ 488.569902] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.575447] ? refcount_inc_not_zero_checked+0x1e5/0x2f0 [ 488.580913] ? refcount_add_not_zero_checked+0x330/0x330 [ 488.586377] ? kasan_kmalloc+0xc7/0xe0 [ 488.590278] security_prepare_creds+0x60/0xc0 [ 488.594782] prepare_creds+0x3b9/0x4d0 [ 488.598689] ? abort_creds+0x2a0/0x2a0 [ 488.602584] ? __ext4_journal_stop+0x106/0x1f0 [ 488.607181] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.612726] ? ext4_xattr_set+0x335/0x420 [ 488.616933] smack_inode_copy_up+0x145/0x1b0 [ 488.621346] security_inode_copy_up+0x54/0xb0 [ 488.625847] ovl_copy_up_locked+0x335/0x1810 [ 488.630277] ? __sanitizer_cov_trace_cmp1+0x17/0x20 [ 488.635336] ? ovl_set_origin+0x130/0x130 [ 488.639485] ? fsnotify_first_mark+0x350/0x350 [ 488.644090] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.649632] ? evm_inode_post_setxattr+0x39/0x130 [ 488.654488] ? up_write+0x7b/0x220 [ 488.658029] ? up_read+0x110/0x110 [ 488.661574] ? __vfs_setxattr_noperm+0x19b/0x410 [ 488.666339] ? vfs_setxattr+0x70/0x100 [ 488.670237] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.675779] ? ovl_check_setxattr+0xc5/0x130 [ 488.680196] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.685737] ovl_copy_up_one+0x1429/0x1970 [ 488.689977] ? ovl_copy_up_locked+0x1810/0x1810 [ 488.694647] ? dput.part.26+0x241/0x790 [ 488.698626] ? lock_downgrade+0x900/0x900 [ 488.702781] ? lockref_get_not_zero+0x70/0x90 [ 488.707287] ? dget_parent+0x1a5/0x6a0 [ 488.711184] ? lock_downgrade+0x900/0x900 [ 488.715336] ? kasan_check_read+0x11/0x20 [ 488.719516] ovl_copy_up_flags+0x14e/0x1d0 [ 488.723770] ovl_copy_up_with_data+0x1a/0x20 [ 488.728183] ovl_setattr+0x22f/0xaf0 [ 488.731906] ? smk_curacc+0x7f/0xa0 [ 488.735545] ? ovl_fill_inode+0x6f0/0x6f0 [ 488.739694] ? smack_inode_rename+0x370/0x370 [ 488.744190] ? lock_acquire+0x1ed/0x520 [ 488.748173] ? current_time+0x131/0x1b0 [ 488.752157] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.757700] ? evm_inode_setattr+0x6f/0x170 [ 488.762024] ? ovl_fill_inode+0x6f0/0x6f0 [ 488.766180] notify_change+0xbde/0x1110 [ 488.770172] ? setattr_prepare+0x830/0x830 [ 488.774422] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.779977] ? dentry_needs_remove_privs.part.25+0x54/0x70 [ 488.785630] do_truncate+0x1bd/0x2d0 [ 488.789371] ? file_open_root+0x580/0x580 [ 488.793549] ? inode_permission+0xb2/0x560 [ 488.797789] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.803346] vfs_truncate+0x60e/0x840 [ 488.807156] ? do_truncate+0x2d0/0x2d0 [ 488.811156] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 488.816699] ? getname_flags+0x26e/0x5a0 [ 488.820768] do_sys_truncate+0x156/0x190 [ 488.824835] ? vfs_truncate+0x840/0x840 [ 488.828826] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 488.834208] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 488.839680] __x64_sys_truncate+0x54/0x80 [ 488.843873] do_syscall_64+0x1b9/0x820 [ 488.847767] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 488.853144] ? syscall_return_slowpath+0x5e0/0x5e0 [ 488.858551] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 488.863407] ? trace_hardirqs_on_caller+0x310/0x310 [ 488.868434] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 488.873470] ? prepare_exit_to_usermode+0x291/0x3b0 [ 488.878495] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 488.883351] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 488.888551] RIP: 0033:0x457579 [ 488.891747] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 488.910654] RSP: 002b:00007f91b49a1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 488.918369] RAX: ffffffffffffffda RBX: 00007f91b49a1c90 RCX: 0000000000457579 [ 488.925644] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 488.932918] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 488.940207] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f91b49a26d4 [ 488.947480] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000005 14:02:26 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='\x00\x00\x00', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f00000001c0)={0x2, {{0x2, 0x4e20, @local}}}, 0x88) write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x400000, 0x0) socketpair(0xa, 0x2, 0x8, &(0x7f0000000100)) openat$full(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/full\x00', 0x41, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000540)='/dev/fuse\x00', 0x2, 0x0) read$FUSE(r1, &(0x7f00000030c0), 0x17f) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000280)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="7573654e03b29533dc5b15d17ebf722e2f6465762f0373626d6f6e23003725390945adc6013e18a77afb515c51e6ff433d8cca67d5530cafdcd56f2a1af9dd9e42212c5dd9ba4b058979d1e7b9045e7b7a7de28161b84fef8b173779a770556fd8f05de36da964d8bccf9a9f6ccddd9dddbc66d56a55333faecb098bc50de0efe72949bd17ad25b9a40beca8e8163d8795fde0bf57f97a4bc496b93850c20fc1c59f07"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000) 14:02:26 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000b6500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 488.989008] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:26 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20005e00) 14:02:26 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x1000000000000000) 14:02:26 executing program 2 (fault-call:9 fault-nth:5): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 489.187600] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 489.213000] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:27 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000175e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:27 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xf5ffffff00000000) 14:02:27 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) write$FUSE_BMAP(r1, &(0x7f0000000240)={0x18, 0x2, 0x4, {0x4}}, 0x18) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 489.301152] FAULT_INJECTION: forcing a failure. [ 489.301152] name failslab, interval 1, probability 0, space 0, times 0 14:02:27 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000017a) [ 489.395666] CPU: 1 PID: 26973 Comm: syz-executor2 Not tainted 4.19.0-rc6+ #43 [ 489.402986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 489.412338] Call Trace: [ 489.414965] dump_stack+0x1c4/0x2b4 [ 489.418612] ? dump_stack_print_info.cold.2+0x52/0x52 [ 489.423815] ? ovl_copy_up_flags+0x14e/0x1d0 [ 489.428245] ? ovl_copy_up_with_data+0x1a/0x20 [ 489.432841] ? ovl_setattr+0x22f/0xaf0 [ 489.436751] ? notify_change+0xbde/0x1110 [ 489.440908] ? vfs_truncate+0x60e/0x840 [ 489.444905] should_fail.cold.4+0xa/0x17 [ 489.448984] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 489.450369] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 489.454108] ? fs_reclaim_acquire+0x20/0x20 [ 489.454125] ? __lockdep_init_map+0x105/0x590 [ 489.454141] ? lockdep_init_map+0x9/0x10 [ 489.454160] ? debug_mutex_init+0x2d/0x60 [ 489.479105] ? __mutex_init+0x1f7/0x290 [ 489.483080] ? __ia32_sys_membarrier+0x150/0x150 [ 489.487836] ? kasan_unpoison_shadow+0x35/0x50 [ 489.492425] ? kasan_kmalloc+0xc7/0xe0 [ 489.496319] ? fs_reclaim_acquire+0x20/0x20 [ 489.500643] ? lock_downgrade+0x900/0x900 [ 489.504793] ? ___might_sleep+0x1ed/0x300 [ 489.508944] ? arch_local_save_flags+0x40/0x40 [ 489.513528] ? smack_log+0x423/0x590 [ 489.517244] __should_failslab+0x124/0x180 [ 489.521526] should_failslab+0x9/0x14 [ 489.525325] kmem_cache_alloc+0x2be/0x730 [ 489.529472] ? smk_tskacc+0x3dd/0x520 [ 489.533276] __d_alloc+0xc8/0xcc0 [ 489.536727] ? smack_privileged+0xd0/0xd0 [ 489.540880] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 489.545896] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 489.550910] ? map_id_up+0x193/0x3d0 [ 489.554624] ? refcount_inc_not_zero_checked+0x1e5/0x2f0 [ 489.560072] ? make_kprojid+0x30/0x30 [ 489.563878] ? refcount_add_not_zero_checked+0x330/0x330 [ 489.569331] ? kasan_kmalloc+0xc7/0xe0 [ 489.573217] ? smk_curacc+0x7f/0xa0 [ 489.576847] ? smack_inode_permission+0x2bc/0x3b0 [ 489.581704] ? smack_file_ioctl+0x3c0/0x3c0 [ 489.586022] ? __sanitizer_cov_trace_cmp2+0x19/0x20 [ 489.591038] ? security_capable+0x99/0xc0 [ 489.595208] d_alloc+0x96/0x380 [ 489.598487] ? __d_alloc+0xcc0/0xcc0 [ 489.602201] ? security_inode_permission+0xd2/0x100 [ 489.607415] ? inode_permission+0xb2/0x560 [ 489.611651] vfs_tmpfile+0xd2/0x2a0 [ 489.615303] ovl_copy_up_locked+0x5ca/0x1810 [ 489.619711] ? __sanitizer_cov_trace_cmp1+0x17/0x20 [ 489.624727] ? ovl_set_origin+0x130/0x130 [ 489.628880] ? fsnotify_first_mark+0x350/0x350 [ 489.633466] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 489.639005] ? evm_inode_post_setxattr+0x39/0x130 [ 489.643845] ? up_write+0x7b/0x220 [ 489.647399] ? up_read+0x110/0x110 [ 489.650943] ? __vfs_setxattr_noperm+0x19b/0x410 [ 489.655696] ? vfs_setxattr+0x70/0x100 [ 489.659589] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 489.665124] ? ovl_check_setxattr+0xc5/0x130 [ 489.669533] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 489.675072] ovl_copy_up_one+0x1429/0x1970 [ 489.679308] ? ovl_copy_up_locked+0x1810/0x1810 [ 489.683978] ? dput.part.26+0x241/0x790 [ 489.687958] ? lock_downgrade+0x900/0x900 [ 489.692110] ? lockref_get_not_zero+0x70/0x90 [ 489.696607] ? dget_parent+0x1a5/0x6a0 [ 489.700491] ? lock_downgrade+0x900/0x900 [ 489.704637] ? kasan_check_read+0x11/0x20 [ 489.708812] ovl_copy_up_flags+0x14e/0x1d0 [ 489.713047] ovl_copy_up_with_data+0x1a/0x20 [ 489.717452] ovl_setattr+0x22f/0xaf0 [ 489.721166] ? smk_curacc+0x7f/0xa0 [ 489.724791] ? ovl_fill_inode+0x6f0/0x6f0 [ 489.728942] ? smack_inode_rename+0x370/0x370 [ 489.733434] ? lock_acquire+0x1ed/0x520 [ 489.737415] ? current_time+0x131/0x1b0 [ 489.741397] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 489.746938] ? evm_inode_setattr+0x6f/0x170 [ 489.751260] ? ovl_fill_inode+0x6f0/0x6f0 [ 489.755408] notify_change+0xbde/0x1110 [ 489.759389] ? setattr_prepare+0x830/0x830 [ 489.763627] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 489.769163] ? dentry_needs_remove_privs.part.25+0x54/0x70 [ 489.774789] do_truncate+0x1bd/0x2d0 [ 489.778501] ? file_open_root+0x580/0x580 [ 489.782643] ? inode_permission+0xb2/0x560 [ 489.786889] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 489.792428] vfs_truncate+0x60e/0x840 [ 489.796231] ? do_truncate+0x2d0/0x2d0 [ 489.800120] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 489.805656] ? getname_flags+0x26e/0x5a0 [ 489.809722] do_sys_truncate+0x156/0x190 [ 489.813785] ? vfs_truncate+0x840/0x840 [ 489.817757] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 489.823121] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 489.828577] __x64_sys_truncate+0x54/0x80 [ 489.832724] do_syscall_64+0x1b9/0x820 [ 489.836614] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 489.841989] ? syscall_return_slowpath+0x5e0/0x5e0 [ 489.846923] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 489.851786] ? trace_hardirqs_on_caller+0x310/0x310 [ 489.856803] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 489.861817] ? prepare_exit_to_usermode+0x291/0x3b0 [ 489.866833] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 489.871688] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 489.876881] RIP: 0033:0x457579 [ 489.880076] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 489.898975] RSP: 002b:00007f91b49a1c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 489.906685] RAX: ffffffffffffffda RBX: 00007f91b49a1c90 RCX: 0000000000457579 [ 489.913983] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 489.921248] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 489.928510] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f91b49a26d4 [ 489.935774] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000003 14:02:27 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000a600) [ 490.000315] overlayfs: './file0' not a directory [ 490.015397] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:27 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000f9a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:27 executing program 2 (fault-call:9 fault-nth:6): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:27 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x20000000) 14:02:27 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001a1000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 490.148187] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:27 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000ef00) [ 490.203773] FAULT_INJECTION: forcing a failure. [ 490.203773] name failslab, interval 1, probability 0, space 0, times 0 14:02:28 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x10000000) 14:02:28 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="c1643d", @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) r2 = memfd_create(&(0x7f0000000100)='/dev/fuse\x00', 0x4) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f00000001c0)={0x2, [0x4f39a857, 0x7]}, &(0x7f0000000200)=0x8) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 490.257190] CPU: 1 PID: 27033 Comm: syz-executor2 Not tainted 4.19.0-rc6+ #43 [ 490.264534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 490.273894] Call Trace: [ 490.276496] dump_stack+0x1c4/0x2b4 [ 490.280148] ? dump_stack_print_info.cold.2+0x52/0x52 [ 490.285364] should_fail.cold.4+0xa/0x17 [ 490.285391] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 490.285479] ? mark_page_accessed+0xcb0/0x2040 [ 490.299142] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 490.304691] ? activate_page+0x1040/0x1040 [ 490.308945] ? mark_held_locks+0x130/0x130 [ 490.313195] ? is_bpf_text_address+0xac/0x170 [ 490.317703] ? lock_downgrade+0x900/0x900 [ 490.321866] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 490.327685] ? mark_held_locks+0x130/0x130 [ 490.331937] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 490.337215] ? rcu_bh_qs+0xc0/0xc0 [ 490.340753] ? unwind_dump+0x190/0x190 [ 490.344643] ? ___might_sleep+0x1ed/0x300 [ 490.348790] ? arch_local_save_flags+0x40/0x40 [ 490.353379] ? mark_held_locks+0x130/0x130 [ 490.357614] ? activate_page+0x1040/0x1040 [ 490.361851] __should_failslab+0x124/0x180 [ 490.366097] should_failslab+0x9/0x14 [ 490.369903] kmem_cache_alloc+0x2be/0x730 [ 490.374109] ? ratelimit_state_init+0xb0/0xb0 [ 490.378610] ext4_alloc_inode+0xc7/0x870 [ 490.382714] ? bpf_prog_kallsyms_find+0xde/0x4a0 [ 490.387471] ? ratelimit_state_init+0xb0/0xb0 [ 490.391972] ? get_cached_acl+0x35c/0x460 [ 490.396119] ? lock_downgrade+0x900/0x900 [ 490.400298] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 490.406134] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 490.411153] ? ratelimit_state_init+0xb0/0xb0 [ 490.415646] alloc_inode+0x63/0x190 [ 490.419271] new_inode_pseudo+0x71/0x1a0 [ 490.423329] ? prune_icache_sb+0x1c0/0x1c0 [ 490.427567] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 490.433374] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.438913] ? __ext4_xattr_set_credits+0x3ae/0x520 [ 490.443930] new_inode+0x1c/0x40 [ 490.447298] __ext4_new_inode+0x4cd/0x65b0 [ 490.451556] ? is_bpf_text_address+0xd3/0x170 [ 490.456064] ? __kernel_text_address+0xd/0x40 [ 490.460560] ? unwind_get_return_address+0x61/0xa0 [ 490.465490] ? ext4_free_inode+0x1a10/0x1a10 [ 490.469899] ? save_stack+0xa9/0xd0 [ 490.473518] ? save_stack+0x43/0xd0 [ 490.477139] ? kasan_kmalloc+0xc7/0xe0 [ 490.481023] ? kasan_slab_alloc+0x12/0x20 [ 490.485169] ? kmem_cache_alloc+0x12e/0x730 [ 490.489500] ? __d_alloc+0xc8/0xcc0 [ 490.493120] ? d_alloc+0x96/0x380 [ 490.496579] ? vfs_tmpfile+0xd2/0x2a0 [ 490.500383] ? ovl_copy_up_locked+0x5ca/0x1810 [ 490.504983] ? ovl_copy_up_one+0x1429/0x1970 [ 490.509417] ? ovl_copy_up_flags+0x14e/0x1d0 [ 490.513820] ? ovl_setattr+0x22f/0xaf0 [ 490.517709] ? mark_held_locks+0x130/0x130 [ 490.521942] ? do_syscall_64+0x1b9/0x820 [ 490.526005] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 490.531371] ? lock_downgrade+0x900/0x900 [ 490.535523] ? lock_release+0x970/0x970 [ 490.539498] ? memcg_kmem_get_cache+0x3a9/0x9d0 [ 490.544164] ? mem_cgroup_handle_over_high+0x130/0x130 [ 490.549438] ? lock_downgrade+0x900/0x900 [ 490.553602] ? percpu_ref_put_many+0x13e/0x260 [ 490.558210] ? trace_hardirqs_on+0xbd/0x310 [ 490.562531] ? mem_cgroup_charge_statistics+0x780/0x780 [ 490.567900] ? kasan_unpoison_shadow+0x35/0x50 [ 490.572480] ? kasan_kmalloc+0xc7/0xe0 [ 490.576379] ? kasan_slab_alloc+0x12/0x20 [ 490.580528] ? kmem_cache_alloc+0x306/0x730 [ 490.584845] ? __lockdep_init_map+0x105/0x590 [ 490.589378] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.594920] ? d_set_d_op+0x31d/0x410 [ 490.598721] ? __d_alloc+0x73f/0xcc0 [ 490.602439] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.607976] ? __dquot_initialize+0x629/0xdd0 [ 490.612474] ? lock_downgrade+0x900/0x900 [ 490.616636] ? dquot_get_next_dqblk+0x180/0x180 [ 490.621301] ? kasan_check_read+0x11/0x20 [ 490.625462] ? do_raw_spin_unlock+0xa7/0x2f0 [ 490.629904] ext4_tmpfile+0x187/0x4e0 [ 490.633709] ? ext4_orphan_add+0xdb0/0xdb0 [ 490.637941] ? security_inode_permission+0xd2/0x100 [ 490.642963] ? inode_permission+0xb2/0x560 [ 490.647194] vfs_tmpfile+0x13b/0x2a0 [ 490.650914] ovl_copy_up_locked+0x5ca/0x1810 [ 490.655320] ? __sanitizer_cov_trace_cmp1+0x17/0x20 [ 490.660351] ? ovl_set_origin+0x130/0x130 [ 490.664506] ? fsnotify_first_mark+0x350/0x350 [ 490.669145] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.674682] ? evm_inode_post_setxattr+0x39/0x130 [ 490.679522] ? up_write+0x7b/0x220 [ 490.683054] ? up_read+0x110/0x110 [ 490.686593] ? __vfs_setxattr_noperm+0x19b/0x410 [ 490.691357] ? vfs_setxattr+0x70/0x100 [ 490.695258] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.700794] ? ovl_check_setxattr+0xc5/0x130 [ 490.705215] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.710756] ovl_copy_up_one+0x1429/0x1970 [ 490.714991] ? ovl_copy_up_locked+0x1810/0x1810 [ 490.719660] ? dput.part.26+0x241/0x790 [ 490.723633] ? lock_downgrade+0x900/0x900 [ 490.727788] ? lockref_get_not_zero+0x70/0x90 [ 490.732286] ? dget_parent+0x1a5/0x6a0 [ 490.736177] ? lock_downgrade+0x900/0x900 [ 490.740323] ? kasan_check_read+0x11/0x20 [ 490.744498] ovl_copy_up_flags+0x14e/0x1d0 [ 490.748739] ovl_copy_up_with_data+0x1a/0x20 [ 490.753144] ovl_setattr+0x22f/0xaf0 [ 490.756864] ? smk_curacc+0x7f/0xa0 [ 490.760497] ? ovl_fill_inode+0x6f0/0x6f0 [ 490.764645] ? smack_inode_rename+0x370/0x370 [ 490.769143] ? lock_acquire+0x1ed/0x520 [ 490.773120] ? current_time+0x131/0x1b0 [ 490.777098] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.782633] ? evm_inode_setattr+0x6f/0x170 [ 490.786958] ? ovl_fill_inode+0x6f0/0x6f0 [ 490.791109] notify_change+0xbde/0x1110 [ 490.795088] ? setattr_prepare+0x830/0x830 [ 490.799325] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.804870] ? dentry_needs_remove_privs.part.25+0x54/0x70 [ 490.810500] do_truncate+0x1bd/0x2d0 [ 490.814214] ? file_open_root+0x580/0x580 [ 490.818363] ? inode_permission+0xb2/0x560 [ 490.822612] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.828150] vfs_truncate+0x60e/0x840 [ 490.831956] ? do_truncate+0x2d0/0x2d0 [ 490.835844] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 490.841397] ? getname_flags+0x26e/0x5a0 [ 490.845464] do_sys_truncate+0x156/0x190 [ 490.849528] ? vfs_truncate+0x840/0x840 [ 490.853501] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 490.859021] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 490.864475] __x64_sys_truncate+0x54/0x80 [ 490.868627] do_syscall_64+0x1b9/0x820 [ 490.872516] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 490.877889] ? syscall_return_slowpath+0x5e0/0x5e0 [ 490.882819] ? trace_hardirqs_on_caller+0x310/0x310 [ 490.887846] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 490.892893] ? recalc_sigpending_tsk+0x180/0x180 [ 490.897645] ? kasan_check_write+0x14/0x20 [ 490.901887] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 490.906754] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 490.911943] RIP: 0033:0x457579 [ 490.915138] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 490.934082] RSP: 002b:00007f91b4980c78 EFLAGS: 00000246 ORIG_RAX: 000000000000004c [ 490.941787] RAX: ffffffffffffffda RBX: 00007f91b4980c90 RCX: 0000000000457579 [ 490.949050] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000200 [ 490.956339] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 490.963629] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f91b49816d4 [ 490.970896] R13: 00000000004bde66 R14: 00000000004d8400 R15: 0000000000000007 14:02:28 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:28 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000880)={0x28, 0x3, 0x0, {0x1, 0x4, 0x0, 'user_id'}}, 0x28) r2 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r2, &(0x7f0000000e40)={&(0x7f0000000100)={0x2, 0x4e22, @rand_addr=0x147222c9}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000030c0)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/113, 0x71}, {&(0x7f0000000480)=""/151, 0x97}, {&(0x7f0000000540)=""/71, 0x47}, {&(0x7f00000005c0)=""/251, 0xfffffffffffffde7}, {&(0x7f00000040c0)=""/4096, 0xfffffffffffffee2}], 0x6, &(0x7f0000002100)=[@zcopy_cookie={0x18, 0x114, 0xc, 0xfff}, @zcopy_cookie={0x18, 0x114, 0xc, 0x2}, @mask_fadd={0x0, 0x114, 0x8, {{0x40, 0x7ff}, &(0x7f0000002080)=0x3, &(0x7f00000020c0), 0xffffffffffff8000, 0x7, 0xfffffffffffffff7, 0x7, 0x44}}, @zcopy_cookie={0x18, 0x114, 0xc, 0x7}, @mask_fadd={0x58, 0x114, 0x8, {{0x81, 0x1}, &(0x7f00000003c0)=0x3, &(0x7f0000000b80)=0x1f, 0x100, 0x401, 0x6, 0x6, 0x28, 0x1}}, @zcopy_cookie={0x18, 0x114, 0xc, 0x7f}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000000bc0)=""/207, 0xcf}, &(0x7f0000000cc0), 0x20}}], 0x130, 0x4040040}, 0x40050) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RWRITE(r3, &(0x7f0000000800)={0xb, 0x77, 0x2, 0x4}, 0xb) read$FUSE(r1, &(0x7f0000009140), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) getresuid(&(0x7f0000000fc0), &(0x7f0000002000), &(0x7f0000002040)=0x0) ioctl$DRM_IOCTL_INFO_BUFS(r3, 0xc0106418, &(0x7f0000000840)={0x59, 0x7f, 0x200, 0x7, 0x1f, 0x7}) syz_mount_image$hfsplus(&(0x7f0000000e80)='hfsplus\x00', &(0x7f0000000ec0)='./file0\x00', 0x20, 0x2, &(0x7f0000000f80)=[{&(0x7f00000060c0)="43bdc4af2a98c6f288a3f43c8299ea69185d0180bda46462efe05a7ede62f2ee1ceee5e0b871dac262355b2118b5af445c7cc9800f87b9fd85ff6e82a5abd91276929fc82e78fd719cc6187d73c67e85e18b2104d4128b132a709dbfad3cd69e5ce20b3765604575d5af225bf633eb30278b8f3f35626627c9f21a0719c599210bb0bd3e2d7d456456cc951321c5d0e1a54263a619a7b06ada37330ba5c5a0b169888af35a43896318dd41339f1984ac626cf1f68081027176bac41fd4cb59b33a7fc5c4ec642eb1deb3aedc09d19376845a450f57a624866e82b0446b80e055378e7c1ffdbaeb9918cb026e8f6502ca2158afa111cd5fd330d0698fd4e27b0a389f9f84e734f392630499fbb844f51b3e1778c30f1e099bae35994ed3b67b3af1798e7aa42c2862bbb0c9f50e711f0479f97f6cafa6f22d93213599735ede07d21a87bc25dd848a39c63a83aad9005fb0ecb4f3e15afe624d31ceb616818cf4871e0b3a9ecf2b1862f8712a43723dcba69e5864e6cbe9bf86f13f5e3953d7649b2c209816b186ad465c0cafa8b293bb6b640645ddbaac6318fb838bf706398f25e85fe5515767cad45a35a4cbb85d75dcb006c1ef1200a460ba1268332758f9fe1a0c567ce8f3fb11320ff200bd864861b6e7a402193d3b25407c35b4103f1cb7ce6e2efe129858aaafd876592fbcefbeae50dc74041dd5b110f530de5eb22eff762b1d4bf23dbd78101e80a418e91606ad25bb79d1b4150b8d223a8c6469cb02050a2d8682bc7ee34275e634607047247c59e6494d7153013d9c0efa36e44ab79892e046a3af67cf6792cc0b97001d30df98ba5ea562147ddc419a3fa8bf431c759cde8ca74d8706426d505001eaa452889ec9df02311af8bc764f8c35605ab98c7f10d5c18e4cf4e2135713e99734e064ad301fd0af0cadb5dfb15b81c40a4e0b2c35bdda2c48293178f751758c1b1b46ec33f7dc6b913b721ae3e1a256ba58e8e86c213488d5548215089c1f577f848e5a41b9e20fbced2c3929b89ade91f91ef51422487d9307ba549dfa84f1e45f1a7588d6ae7c728fddba7d3cf9e1267849a2aa20fe6736b3f344944a630b149bf06cac9e4d64b4783d30f34bfecc2395cc711220a78292c9b9692c0c20daee25471462d4aa092b009486e16714b6a8d6a09b57a135e68a1f03ac2c74fd0006a36739a4aea576e03739f767ae86a238bccf637fee5137c61916d8f9df34c4fe5b9539abfd9542fcbca0904107cb3bdc1ee00343f50765edcbc1b284c1ac3ada5439f82eb7c8ef226d2a7c87b6f2f06a4e6821d20ea35be9d2e738898b5be075f702ff0d90bc3d797af8e88f78dd6a133926818a0223f4cd8aad9c5d551f6dfd59b04ccf380af40ec793e04e5c7383f2aca52671f3408f5619f9dce2dc4c5549f50064d3cfceab968e8b454ba4341316cdbe00c6df3d7951ccc5828636996fbed67e0a91bd20a2c8f0c55b77bca25c0a2fa747e894924876e6883031b0d1472dda7c70742b5de2a7d345ef1e3c4b3c92bc937513746c03b4dad90adf1024047457267d105bbf0b989a14338b8b272c007dcf858597ec63eff156b99c7f989ca9e6e28bdc51a26742533b51645d48ffc70466c2bf2eba13263e3186c4a27713605977c74d90675b662b67d0adbba6f7f273e6193ed2672fbe8900f7871fb70f2049e7227f7771b8d8c6138277324a9ffdeb93e18bb5dd4344bbe84938906382bc9cd7ef608d343eed8a00fc2993b6792789d8c02290c657e9f1daebf437f3a7645759d64642a24c3d0cf8ab3763a056a455223521aefb17d5c7078297c1304f2e5db9f2f8a34bcfb4c3e6a963288c53c7a6bfea2cc545f6f64a06cef8971322e19889e801cba44f36a320b1e8cb8e63404ccf9192bca9f1ea6227e3e9a22d309bad311c4bc1f1df9391955747d9f14a7cbef9d19d0fc3f5be8bdfa97eee963cc7f0ea7b24d3fba0db2d2149059a4bbb317558f4ab83d33531fcbd675e843737240e19c9966a38e514bbc512eed95820ea00f5ce698277f17a6ad79445aabbac9b5aad8bc7e4494767f78167a60dc1f0ccf0ac6711d1af37d1ef9e0c61acf749fb92243fde21f8d900e44c295004cc3fa19d9f1be567f22109af3c85bed5cd91cd60820777ea7fe9c4146d62a1e7285df6cc782ce4e99d8c1f244582369344164da65430c5deeb7591cdb097fa752b448855df43f51c981859626044fe82968aac77f38e2336b954be892b542b6b1a06cf86befbdc415bfb68307f028e3420d75941b0a26161673f8076a872881eb644fd5aadf8fb893b42ab58141b8de049b021fbc88a8fbeb18be684e75765204aa06b6e38d310b71c7287635d52f9d6e17896aee6cc2009667b0876ebdba3a9c1c9f3b8832c3d036decc0edc6a52312ddcd77117e052a288e108c8f9e621f6dd6bc2a6ae03222b3473838bdb11de63eaa6bd6ae7c89b8b339f28a0c40036aaaabbe4d6155e46e98351f18326b10ccc8172c981865ecab4cc2594c7180e94064cdc004b479c1d9df1a3e73c40bf48159f749a7deeff8a455a1755232a6bcb581334101e187dfe5a32130317a17e8275df8e8e060453fd1295a86a3595f89d7b4fcbd138538151fe98ea2459974208c1e137e5d295d043d7e8e980761dbb6652f8bc52c7b76d2515d783d0788f83f34b96de5a2b74ca69c4758f006920177441a341056e0e6f54fd4b5a8d6ec53dfee79432b38f5573a9eb4065315a715461d873922c566407988c9fb51dd2f5ad57ed1da5c7625d4cfee2fe2007e55450d7f155c5a8c71e21b15ee1e4c9c6b381c51b5a99ead14e604061e5422665a06b6b731fadce12ea3280d8be86aef47739e87a1e1d0cd662beb4ea67e49dadd4559e925e8022d8de7cf6f233e3dc42305c594fc11681ab13f41a522268135f42cb1024249c33a534500ca538d7364f03f0869adca2ed326206601de7d22147da368edf49d99867f7b2aa7c44b6435dfdf1d5fa445c91e958cb0009fd352b6b3fb1607b57c0a4bd65541eeda0badbd4ce41249a945d86b81ab3cb03dd20a0bb71ff3b460fdf63b81fb41c3345fb15266d600fadba4e188496f092c0928743202417e4b087f12b2f7f1337bfaaf6f8394a9a37b3e5f93637508a1daf0087cc785a2e3f33416d7b6241ed05829718e599270d2eec8c57d5554fb72dac67905d084c29e3d9b56150ce5e8f6bb2290db85c3ad008c99aa908ac7fbc3317406f1e1da231748486bd588519268efbc923e37a083686bc7f26013ab9312f8fd34cacc628624336bb83cd3fae462f5ec5b5f3ee61112f0acae2072b6ddfdb40446177fa5f3a9b2146c1790280b8eff36fd95547f8e7030052036b2ec6c2777691d97d6b5c920822d654a7e9756658f1add4617c2a77c70fefe23e83bcef99790505de064099a947ceb47b9f36091dfd26d038422a04751ac48dd5681c1cc6b1eba020bb1efadb5f799b866c05f8ff3baac6e0da722ce9c5f87dd3b0ffc2eb20992b7d05f4b0ed206038c0ed9485afe532e1004c0c5d69c611ab98f03cbba17b01a77215b0ab5ec22d81c5e3b4a4b468f6f50f12363b11880c78e0b641f86abc276a5829a0acb87c6bb6ff6ca40838c2dc5e4203cb0a1e922a5e2fb5c208097d1bc10937cad027dc8217fd1f6c6a9001649d036047ed7dadc096551b9ffea80490ec1b9459cc944ea888f4f15deea899d6f355ff3447b4b94e4397dbb1459357d7fd77399d9789519074dc49abbdb4bb5a7e1bbdb7b5e1c94957ffbbed9fc87b59b133a4374aabfb9c238772d3b994d2403b44d1f6c72475fabbf6eda5a616f5df48181288a8d3bef46cf5dd2ac6890b682f0e2eacf4f52fbc1b74df271602ec60c632109be2a831969d3b39151ea09bdb75004b57295b818df6f0dba16f997d05e39c723b37a369957553a8a448eee77626cddf85b049091036166ce4476556f03a15233a2afb997937a86fc979b815b31f93a2b3e850ae7591fe5ff6c1b7495a98d6ac21fa4d6fffa5c07192d79aa096016a2044e9cca434677d4cd68a16f7a1b1a54f9a3bc7330f2164b39b0bb0d1025948566452963ee7b13564ad8105e908e5110820b8dc4b76a6c8b10240416c7bcb778f6014440887a1af858acb3d97f8073444200aec9d5d0697adf20cee8e215daf94c5664576dda34ef542bf09d943c835a41c91f87b4763ce8796859986df248010f98bb925c25f8bbc9f923d2ad4e58a5ac0a527cb8453f4fa458007a0c0c2425c9852e29823d520e828be87b591a97b40d4f0611a35f99636e4cf6cb04d4e25c686b05267f77aed6fb56b0aca97a6d1ecda610fc29496922c55d373001de114974013f0e4174cf89822b4aa513120159853a108c0d7368f82d596a6ea2a5ad4d2f99bb05f0b8895fd2d3442ac4818171acba3bbea35fa4b21e18ae30dfcb0d3eb8aabb3c3bbffd7a6bc05b7d83b6a82e8f32ccf01f5e71de97cd653d2474af8dc023f4af699965c9ac90bcd6d2d8503426f87f0d61074b10bf01adca234fb778c31adb8bd33a22227acaa017f7a4ce1f96159a4fe0fd2949cd3fb48e0cc99b769ebc15b46beef4f7fdd39ed7174566e1da882dd599a9ea9276a544d9798f0934210a27e6113841fd28a0dfb6161f46689a7345e8ebbbb57f4a1bd90d7f0e68b721809665bd63ce73bdd0bc53bf85560be7f5a6f46d4ed4808264e6662f995d58ee1cf80bbde1975c93268bfd3c64ff1a079f855878152860da6d34085c6316b7cb1af3296c7d80220f27f03bccdc6dd101a9cf555d46f313a461c2bb8c315e79ccb14accc204c573f7946d1e34811d40e0686453d0b545fa120641b6af7df1d36c153cb44a3e44714ab342fae6b1de72ad64faf4aac5a07ef6253bc536e87b5482c2c2c253d8db1978607128e53da4b11b7f8e0b7de9865bd236d7b13d8b293564c07989caf3537322dd9d441d5ed91e812c80cc1ed879051b01e96593cfbd5ce31fc8b54fb4a2423f297ec35aecd34b35d0d4fcb77ab2201df689c2cbf01993beffcbb3c220aa0aaa3ab96d490268a98040074bdcf94b47dc16682946088766a4a388021a650a9e79a63694b4883f09624098b051fc303bb494a1980a618ac9a036c80896ca23aaecc3e88d22f4182406d22c978905e0ef6f05f2f410af38d53c07d04fcd0b1def6a540e6b36f9502c1fddad74152c268bd02fc46ffc46ca92421f77a6c89f3fc7255dac55c8b1d6760e7da24927b23672cab521e5a093ff0e0b696aeaac342573523b4fff46b85a280ebe806522f88bf931269150f3f37c5d5bd7bcc9cb7b64f11b2eb45b68e5bab96731b098e83cd2eb41871bc2b8cceb9a4276dbea6583a22596d8d8bc3ee303e355632c2abd9bc46244ecf3a11311659766105ca737d99d2deabe0e80669a10afa8594eabb0ec6977495fc9c637e579076595f47339d1f1481a7aee806eacea61eed27821ac04f78043be80af24bebd61148a27aae992fa58dc944ab8b751c9243de51eb3c34b4a6dc6c5d1689b8bab39a49d37eafa57799dbf2b58b27a66bb20cbe3fb3d9ea18ba05351bb3d0593513e4918e86a56ad88bab15c2d01d3fc61d131c878efbbf0001a35596509b9df68a29101a60ec7a8d54699bbf1eec10e6401b7dbbec731a048c9d415f6db31a53226da598b436ae76b838d9f45c6d111345dc5c02a8c7f117576f85ce463d859b926cfa3e5fbd62cad1d9e83810173973f98ff3c6a86af0602984bd19d0ea4b93886a61726800398b43cc3b514d9dfb8c38116f41cd991be3470", 0x1000, 0xfffffffffffffffc}, {&(0x7f0000000f00)="7021e3199e045f8b55e7a3e6241003fb33e662134bb2d60c4a04e0824f2c09cd81b688c7d64f4736aac282da9cf80af231e887de259bb2184f655616a8d0e488240898e1d46d55f5a87f331b6a04342c7aabe813e3469f56b427549eba02cc5fc353e616a3a84005468ae56fc6449cb47fe2c939", 0x74}], 0x1000000, &(0x7f00000070c0)={[{@session={'session', 0x3d, 0x81}}, {@force='force'}], [{@audit='audit'}, {@hash='hash'}, {@fowner_lt={'fowner<', r4}}, {@obj_role={'obj_role', 0x3d, 'rootmode'}}]}) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f00000050c0), 0x1000) 14:02:28 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000005a) 14:02:28 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20003b01) 14:02:28 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xebffffff) 14:02:28 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000240900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 491.257169] hfsplus: unable to parse mount options 14:02:29 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x804000000000000) 14:02:29 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xffffffffffffffff) 14:02:29 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000116e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:29 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x800800000000) 14:02:29 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000239300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 491.479232] overlayfs: './file0' not a directory 14:02:29 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x2000) 14:02:29 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000016d500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 491.702369] overlayfs: './file0' not a directory [ 491.965321] hfsplus: unable to parse mount options 14:02:29 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf00000000000000) 14:02:29 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000ee) 14:02:29 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000008f000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:29 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001e5) 14:02:29 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) setxattr$security_smack_entry(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='security.SMACK64IPOUT\x00', &(0x7f0000000200)="8c6d643573756d00", 0x8, 0x3) 14:02:29 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xf5ffffff) 14:02:29 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfde7) 14:02:29 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xf4ffffff00000000) 14:02:29 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000023fc00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 492.275397] overlayfs: './file0' not a directory 14:02:30 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000170b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:30 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x804000000000000) 14:02:30 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x6) [ 492.299342] overlayfs: './file0' not a directory 14:02:30 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000088900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 492.462407] overlayfs: './file0' not a directory 14:02:30 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000189) 14:02:30 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x200000000000000) 14:02:30 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2dd90ef438ae6b8d7c5262c94b80b5b583533733c3af2a30fa745d27c03158b7039e4e6acb76028afa25bca1cf6ae830e4111e85a8"]) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:30 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x27a4f) 14:02:30 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000f3100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:30 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000019) 14:02:30 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="66643d8024826ad3bbe1d9bdb124f7ee5472e571b9034be162d1ed4646a1d6023876d799c584b200007a2f2b27aeb47c6ceb32e244078201b0f9", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2800000003000000000000000000000001000000000000000700ebffffe948e7ca5cdbffffff747365725f696400"], 0x28) read$FUSE(r0, &(0x7f00000020c0), 0x1000) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) write$FUSE_INIT(r0, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="757365722e8e2494729a65762f00b3d601006ca8ad00"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 492.957374] __ntfs_error: 18 callbacks suppressed [ 492.957384] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 492.995312] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:30 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x804) [ 493.051007] overlayfs: './file0' not a directory [ 493.061507] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. 14:02:30 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000002d200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:30 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) mkdirat(r2, &(0x7f0000000100)='./file0/file0\x00', 0x8000) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2cc1"]) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r3, &(0x7f00000020c0), 0x1000) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000240)) write$FUSE_INIT(r3, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) write$evdev(r2, &(0x7f0000000480)=[{{0x77359400}, 0x1f, 0x3f}, {{0x77359400}, 0x15, 0x9, 0x6}, {{r4, r5/1000+30000}, 0x14, 0xfffffffffffff800, 0x3}, {{0x77359400}, 0x0, 0x4, 0x9}, {{0x77359400}, 0x16, 0x6, 0x200}, {{0x77359400}, 0x14, 0x8001, 0x6}, {{}, 0x17, 0x1dfa, 0x9}], 0xa8) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r2, 0xc0385720, &(0x7f0000000200)={0x0, {}, 0x5, 0x9}) remap_file_pages(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1000000, 0x5, 0x800) read$FUSE(r3, &(0x7f0000001000), 0x1000) 14:02:30 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfffffffe) 14:02:30 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0x8, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 493.222464] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 493.261772] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 493.298734] overlayfs: './file0' not a directory [ 493.323060] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:31 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000de01) 14:02:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001bc600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:31 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x7fffffffffffffff) 14:02:31 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x30) 14:02:31 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000f1) [ 493.789709] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 493.806196] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 493.881721] overlayfs: './file0' not a directory 14:02:31 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfff0) 14:02:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000d3e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 493.912206] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:31 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x2000000000000000) 14:02:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001e5600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 494.138737] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000007fc00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 494.213736] overlayfs: './file0' not a directory 14:02:32 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x804) [ 494.424236] overlayfs: './file0' not a directory [ 494.756697] device bridge_slave_1 left promiscuous mode [ 494.762192] bridge0: port 2(bridge_slave_1) entered disabled state [ 494.769589] device bridge_slave_0 left promiscuous mode [ 494.775015] bridge0: port 1(bridge_slave_0) entered disabled state [ 494.796074] team0 (unregistering): Port device team_slave_1 removed [ 494.804770] team0 (unregistering): Port device team_slave_0 removed [ 494.813256] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 494.824237] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 494.844071] bond0 (unregistering): Released all slaves 14:02:34 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/qat_adf_ctl\x00', 0x20000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x14d) write$UHID_INPUT(r2, &(0x7f00000030c0)={0x8, "c9f70322a3a43743010e2ca63fc52082ac1c7a63952aba945370b8724577b7153795bfd1c4c9b9a3c3772897e293b82c43685ab9d5e05978fbcabe0bf8647cdc0b7d4e4df0ceae25feb7e70105f6666b4601aa54f39759263511f2f28a7787ee47dcd08b858d82e2e5215a47583dad5fd760018684d5eb56c07453c5a3b1915e2df989e552cbf2711e4e47ff22d1cc2ce5d0bbb3dfcf654a2de3a92824b42afbc037dc7cbd07302deaed2a3d5b370d99cc4d012aaa457c99360233df9aeda85ca71016018921d745bf90cbd0b5d462bc76dce86042429e66c11e75e30f755fa31cc5e097d66d386f9e7df6b0e047a7df6a3d367036bb282ce137b60b966c11d7a300a410e442c0b432a4e81c2bcc8be93255d129069d23fc86f93b5f5f1cc98b9c158de9c7cb97a4dd3a3b144e8475ed3c9141f6055d4247b978b82b075763c831296ad9d48d0c3639a8074ef6be85df58a0da9c158e9291ea4bdbfd9d83dcb8b84aa7f10bafc9441e81954f3fb3bbf75f205574ac49fd17cd0f9518c08f54f4d6645cd3ebc4224a87501a5577343c59f7f7962161b31a7f2826dfe03ecde6751f362503a13a8e74b22647640e42911e9b67aa4a79f7d1796e2f8c8d0c37af30a189652e677d8afaba11b9cb966efe11ee89d453cf66cd0899cc0af21b0523b3a88f359588093d1c364c687497b308b2a282ab7386cbdfe24b2c5688595aacd264a7b34f8d8848391140a4b2052d87d0a178c08a6032a9e604fe7a7cfec3c0fdfed7b73909bb3a4a831596cc4d4936438ad11a28dbf0c83e9854a5ab22676bffd52e4ecdf20a8fc580585a7e325ef3e16c9114b8b9a2f4bf960efe4e87ec314ed65bc27d414dd293a016f21ac2be0588d533ad3d1bc5431db5d6f4dbc7f7c9f38c1ef1193e65ecc08ff5a677ac79bb975d311d32b3453d1e15465c12baf41147d6464586f010d819360f28e4d6a4392c76c98b199afb60c385a418d1db9530d8fb6bf330d8fcdab79ac977e4cab9968790a210e90352d34b6f0dd75c7d28cd2c0a786f261ec1d7ec56e1cc2dc3e832098364421464ed546bffe0758c29c1afc9e97eff687bb6f9c9d0766ab1bf66f3791f66d25d940a227e3c45203f9fad8a2fe1b8794aac37786976d0ce2f51607f37dae738fa7ca821fc68f9f8a642acec53086a69f096145f66bc8e0486f2c947d63c0c9e85881b3770fd3664f0ea443697e110a1f9fa795626647e2a291b12d564a4a785c91a654a588ddb7551378c4aa29d631c7509b36a2158f0eb425f3ce40584cd14f77780aca6394821adcf0f42edc1c70af2bfc07b77c61c9452d13fd469e7b1e25b1582a1c265120dc668b25df2771ebb96c8643f7f441bf35885978d8ff850e09f7ad514a7c62fe238731fae6deced76fbae259d5b9b89634f91b982c423a099d1da3940ff1335c10bfba95e5240a967e44ff2620691474483cfbae04a3194c9785f4d2f68f95c0376e86f979502849539da1f05dc90f611b6ad9ebf79b9b50b49b07a3f113681c2ea35751328c60f7cc004bac45848d06d905a4b5e8fd5b4ddefbc75f7ab9312175ee09e9bac7df05b2c0dd05449b0a2e9691e7214d70fa19b012ba45f5a24defb28ecdb10d43b5be18e8455afcd6d24a7c29a6ecfd473b88bf765d1f10276fd9b0daacb3cb933d39b070106452dff93c6530bc3f0ae7ed57fc394b4801285c46a1c3e028eaac5aa2e24a9e71642d9572dcf846d3a3325245cd65c0b81f45539f6ba4f4e8a19aeea6a1e046796a39c6da78eb22fb70b9e09202941eb44b2a1f79c1d43a201590b692789e1b252770f3c1a98b034d6d51bcbc202dfb0b5e8aaaa182019ff92dcb624c4a1753a05c9327140ce307ff72838126e988cae6a74e967538edf7acacaf128dc2a0a886795f202ae85d2677e978c0924e0ae5825c439bd5d96520914470dd41c59a5b53fc721fdc3d6c5d418bb124f4eef36304f918ed1e28917a9a1f58f89eb4838a30ed62af30e4c896c13ebbb74555d37a65117c666caea6e87c1d73edda8210cc538ae917b848ed6f1a179c6d2582322397743646384b097425ad2bf20ce7a3cebdae491afee852f146732524a734989f33fa31d4ea9655bce0fd896429a6589c62ddae4407b56f734540fe7c2e1e19eb10dcfebbe1a779ef41d78d3a8fcdfe9bd620bce36496d5d170be90aeec43c0b8375b7891c02824a0d264df4d6628a671f2ffa049e029db8a68f8b2c96c33f7689e1cbf914a9b4eedeece315ae0e1cbe2a0905fe4db6e447613fee6b8afab6644a887acbb40da92f31b9bf41f4ee73d3105eb60b7d412d51325446dcd64d7ca6d51e38232573ac465c6a1b3fa789290e3b0cdf879f879027d6225aab9bd29cc278b54458eddd43c19c95d9fa38345918fbfe9ae834f62535cd16968b1ccc64970371cbc1a8d9652d729e1f6921ff66f3778228e64ecda323ac1969745b21fa1f9c45ffc38cd8db6140e9a38e34d9f79e38c0adc7c51143d32aa38390213900367bc9a3d8804d262133ee87e382cae3e8e4df0d62b111263a8fa39c4e536c90946acfe8cf39528870ecc2d09338126d2322c54e0fb7ec86f085414c7250adbf96e9138534fb5952ec43c03d7697b5c8a60d2c7e39a0a35be3a5e98aed35d8500702dcaafc9a6bfa8649ba4b579214db69b6c197b6e64cbdde0606d58a04f6ce2489f90860249e5b2de40e0a6ba177c2b6ab9f50a964f4a32b3e84a32ead4016d779b0f647da2e670bf2a1148387c5dc242a0ea8470673b0ab403422e31f19e2b13dbf375846cb482e4915236ba875721ad6ca93c9857f9e3a452db06eb7113596430811f9c8d7e44cc5a2a9f25fa45a9e2e7370f2d1d96148742ba517e492109ef04f861392af80cb9402e260394345c66f2a5a1e5c0e2418c3acb45a3ba6ec1d5f284471e762a968956163bc1dcda87b6f4e6197bebf819dd71f141b07829c6163c5e29db81c4855005ed78e0cb53785c4c3f8c5b05250864052a7005879537ab4dc173d54184150001ebd33e915c20e6a0eabe14607c8119232c4391cce205edf6e4bb4b96997cb0453faaced8f5eed5384fda762c25601bc6f3ba02ee0ee4c987798655318e282182199523ccaff40e17eae43febf76c84ae10c9f7d3e2927aca5d95c54afa3e165ff7516d192ecf310f3cab599731c7b8290f1fab9241c48380feeb93d31c6faa4606d58f8e12071a32390b18058ffbb6f1f4d44c4fc66d25472cb5ed0159bfedd4e26dd4b3eaa0b9c8b38bb0ab7e44de22b8dfe2d9ddb49373beb03f7c23b97b6e216d659a299639f870e923e8a855682fed5bede18ed45c16e12ed6f9921c1877aad49f4ff20d421118da8aefcf072f883eff9c80cecb24e679b7813d6748474c8362aca3c61385ac13fc84e7a53d1f39d6c109f7aa92cde52dde533ce78b5d463c5fd4b8af242242d7e03a03f591d0c51c54b5aac264700d9b8f900b4ae99c1fae6d355f786fb7817b03908affc876ca30fcf2a8dd1021d8c7a49aef846bf8395399eb359a7e0e9445bc0a9128da9e83a8a7a0da0b776ec1853ef53f4a0008a8cfb92727cdbc8e788b952ade15d047f488e1b990fb89922996a6adfe863f15c83a3d50aa12091e1fcbad2d181c0db32ff3245f62eefe7cbd4e37e8653e52e6205973574a0b8b213cb04708296fc80c56750cee78f39dd6cb180d76922d74af82bf1356238b61bb93261e4c7d1e196ed2c9291db049d1124a8241f572ec88575dae4283c0ed35cdda986f78638ef3731292272d0b659c0609e32262af8e3e83356598ade48f5197b3fea9ca4b56c4fd4e97ecd7fe8eb560807cb371fe9955a7be3dfd1009132ea0af89f694b513befec69fb3e4ca9723bd8905404514afffda529d6f8e5ed9b3b10c96dc050770ad9f148cf556dd4b8864f34f8152940de92fce3e778096b8d0bfaeac0b6b1aaf65d70c62d2a7360c8744080ed0c6b8f637525199acbe598509a17d0dc692a55b0aed36822211433c8cd36bb590f82746325dba81603d8e22100db968a7cf1a2ce68be5400505a91e8f0c2018442a24890a1e132c049af0800dc00fc62013069dd466a4670b632c90b0a8e859032f962cfbfe41309ddcf860f399c5c632fd73c7caab102d912c618570a97c8ac7ebac2cfa51947ff7b146a1af8486e3070b1b04f65e7091537a2cb8eb7888d2d5936c677f3ca813272cca0bc0d6796af7933105b8edd6bdda7deed448152a671b23fbfd5b0b72293c57aaee1ccfc1758a37fa41bf39a123976728e197a8eeeaea18fc92cde3cb7451be05f16dcb4cd389955835deae4c22e41252fb38ee4b3e3c06b5f44b85856998321fa5c418bf1b9f6bc6817cf1934e8c558b79a6d2692198a62701434440c07d67abb14b111927b0221101d4b60652223a38f580e182e85dd7192a359f5bae772cc3659d0797b543123ff4c0fe96f4d595868a222756b6741e9935b3aca0d1c7a57525aed06485761b4ba3d02bf1659ff0bbf6ddb0e7fdbea82bd6adfb048384eb37fca6ad69b392f14b643940d6a16e70b4e4786aac9469a9388fb4791d83e787058e747e9e972f42b185c641f5c130e7769b2e1b68bb607a8fc95d069c2941ab6b149212ad89df8eb2ef607d9d995637cd36f416a2f3e839c638d4f4af49c17bf68a895b9788a5357fc1800c8bb84c503cbb51fe380045882eaded8cec3942fd35719bd87831c2e12a64f30215395e62d943534d1e0f60b40bb66bcf9ef2dcdb2f4f3aa3794536a026c49067c136274aa324263e60aa7a542ffa21a2f48dd2c8f319a53f9d8e5368867f0141f23e45ad395aa99506688bfc187757229843a32f1a803baf351d491979a422ea2ed2e30ad1f2090a86058d9d617e018aad51a32e22dbf487198fccd8c51252933b09993df9c6f8c6c5adedb78a55724c7cdb3c5f00b2a48820cca760371ce658e018f70417c6376cd7a1c6b56fad74078293ae39486a34e3e1abb8d4324a647d342d55a320dbce1ead75757babad40f4fd855a9ce97ccb7b09aa0ef34ebc97458602b3ee34d1f3022e6d2c019ceefe382fa2d5165bfd91cb593fa3868de79bb44ab6b721c18d96c63f8355ceee7560653b5190f940e60324c2a8475b05caf01cf32669f5ccc6e8198e636e2332e4b86bec12e42d3c10ef7311ea4fc299fea87dc5d8a025b42bf7f06dc995096cc20486ab8a606542fd6368a0a5d4428d8568ea7114993e98b16294c0ddc3602acce873aaac3a9ecc2d13223246279e9f363417ecdf8bec23b3cd877f6766e5f30aa1be41a2266c9396ce908c08c01dbc5b5419414260c2e922ea0b3e94db40a5eab9873aa7be6c39c696abf24dcd02693fc9657d22845a30262b2ce19043d4aae03568f0c9188dafd78927d23076b0efe4fe17965c060f8151d7680f63433772f335a4d97d89c97ca95091a95dafdd875330f3f9608a4ba17a18fa86b9aa234feafe27ed8c521246639034401f1208ae4ef30e0e81995e30350cb628aae20d83eacfaf56b492507046128f9223a8ddf4c2f13414286310e89e1f277367627e70778b94a708c5d5a75ff4602230babf7e5fd429cff9ed49a8a63a81680169e008e95507ed5dffb88dc354ebea078dea34cb24a9a9c1e6edb2f26b73ccac9a4798c0d92895bfa88f05c8f35b15c2dffd54f44ca3ec875f6fb73d3bd4f90804e885038dec5cf4717b5314c22f2887be54f4c8c4e85a2db2906e42d11ca17feb2e806aca76c72040b73634ad34acbe6918f70d83706299f7024498ae4ed5bff8010662216ae2d2b", 0x1000}, 0x1006) 14:02:34 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20008600) 14:02:34 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000ec) 14:02:34 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xebffffff00000000) 14:02:34 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000006a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:34 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfffffff4) [ 496.485310] QAT: Invalid ioctl [ 496.497166] overlayfs: './file0' not a directory 14:02:34 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf) 14:02:34 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000113800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:34 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xfeffffff) [ 496.671321] IPVS: ftp: loaded support on port[0] = 21 14:02:34 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001fdf00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 496.700563] overlayfs: './file0' not a directory 14:02:34 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x300000000000000) 14:02:34 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xffffff7f) [ 497.274577] QAT: Invalid ioctl [ 497.276930] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.284332] bridge0: port 1(bridge_slave_0) entered disabled state [ 497.293626] device bridge_slave_0 entered promiscuous mode [ 497.316697] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.323049] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.330030] device bridge_slave_1 entered promiscuous mode [ 497.353123] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready 14:02:35 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0xffffffffffffffff) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000a40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x2000, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r1, 0x8917, &(0x7f0000000100)={'veth1_to_bond\x00', {0x2, 0x4e24, @broadcast}}) read$FUSE(r2, &(0x7f0000001000), 0x1000) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f00000001c0)={'tunl0\x00', {0x2, 0x4e20}}) ioctl$SG_SCSI_RESET(r3, 0x2284, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r3, 0x0, 0x61, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000930000004dec51f7b50f33e2fbbcb0d29af6c6fbb08f6482e5743cc8f75ece34f483ac0defd2710cc9def130ea2658d6e1c6f2446413e9f0135e56caafdc95114badc4cbf698af82e5cfca25d2a95ec7add5a827dfdfe0f00f6231a2cc5b992fcebe7d0400000000000000ecd71650352c91e7a64c482a756531c647af3cc2cac13946c1398bbc52299069aa903292a57a5cda45c6a7b6"], &(0x7f0000000240)=0xb7) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000540)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000000640)={&(0x7f00000003c0), 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x50, r4, 0x603, 0x70bd29, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x800) [ 497.375572] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 497.467240] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 497.492651] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 497.591596] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 497.598739] team0: Port device team_slave_0 added [ 497.620355] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 497.627569] team0: Port device team_slave_1 added [ 497.649918] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 497.673700] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 497.698283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 497.722463] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 497.930119] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.936489] bridge0: port 2(bridge_slave_1) entered forwarding state [ 497.943038] bridge0: port 1(bridge_slave_0) entered blocking state [ 497.949413] bridge0: port 1(bridge_slave_0) entered forwarding state [ 498.681200] 8021q: adding VLAN 0 to HW filter on device bond0 [ 498.749276] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 498.817680] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 498.823772] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 498.831493] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 498.897405] 8021q: adding VLAN 0 to HW filter on device team0 14:02:37 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001ae) 14:02:37 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x408) 14:02:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000011a900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:37 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xff00000000000000) 14:02:37 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000e500) 14:02:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x600000, 0x0) ioctl$BLKROGET(r2, 0x125e, &(0x7f00000001c0)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000580)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000005c0)=0x20) getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000600)={r3, 0x80000000}, &(0x7f0000000640)=0x8) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="2800000003000000000000000000000001000000000000000700000000000000757365725f696400b4dfd1866fed2123d6e4ed1ff7c00f960603ca85c71f8bdc7d4e822325c8e52b7ea46d8573ecef8b8fbdb59905b64f00229e81826d3280ea615a00df3f30b5650238fe3027ff577f8c6120476318ce"], 0x28) read$FUSE(r1, &(0x7f0000002000), 0x1000) getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000003c0)={0x0, 0x2}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000500)={r4, 0x10, &(0x7f00000004c0)=[@in={0x2, 0x4e22}]}, &(0x7f0000000540)=0x10) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 500.127374] __ntfs_error: 11 callbacks suppressed [ 500.127383] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 500.154013] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001c6c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 500.195352] overlayfs: './file0' not a directory [ 500.214950] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:38 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x30000000) [ 500.273174] overlayfs: './file0' not a directory 14:02:38 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000228e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:38 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x14000000) 14:02:38 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x3f000000) [ 500.417907] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 500.438784] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:38 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000017b500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 500.553763] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:38 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000004d) 14:02:38 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfffffff6) 14:02:38 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x3f00) 14:02:38 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000bfe00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:38 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000f4) 14:02:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sigaltstack(&(0x7f0000fff000/0x1000)=nil, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x3, 0x100) pwritev(r0, &(0x7f00000008c0)=[{&(0x7f0000000400)="e2bdac2b1c3926016a412155628e99d1908a1131db7d21a8de76836dc4d629bd9f716c757a86da692c16b16e319f6f04599f38f4138e42ddb5b38fb879a8e054cebc9f6bcf55408aa8b1f8c91f71d617af5c1d1bf6c926875faa4065509858f6c3c92c2ac757a576076eb7473964bbf188d4c6c716ec8f8c6c0f983728989683804c71aa8325a209c450ff10aced44369622d492676f42f50d7061544135b18bcf2b2f73ce16a5aaee304bf27e4ea74dfd01c497", 0xb4}, {&(0x7f00000004c0)="4df754b06907322f83f9efbcf9b23d8fecd48ce6f84b569d9181c7dd24142f", 0x1f}, {&(0x7f0000000500)="3d6364a869bde6ced946baf47bcd04acf468136487d4b367d600639531ba4c8bd4054dad661f0600311950c92db3e16c1c47228006d46b8ac6abcc22dc48bc076e0ba71c821a764fdf0c3556a4624c2683e309e0b1", 0x55}, {&(0x7f00000030c0)="5c26057a30d59e8cca7b5db633691fe9edce507a257f704f5066113ae6db613e2f179f4b0f86f5efabe9f6f946712d973bbe3e6259e2f453a19adb34cb9c0652ae73b38e9a33dd1e09c794eb873bf629f5884de22fadfb0da72781faddd843edf26d24a78102222bfdb895d8cff42d8e6a35965144a4abc7cef763213aad547c0257512832de17619a36f26c78cd4bc4ab2fe86c806d5076e66634b1871f04a5a152cdf7de4c9daa4f0efb35713e893faffef45c2bba62fb6f6d4d23fd0522f70726a19099c253cacea6ac3d705bb6200e250e20eaec0ce841493d90b54f31246a964e31bc4422690aeb2d0745bda56af6bde498de694debbdf5bbfbafc779fc2bf53d2d24942757851860f28440819b774aaa5dfd77423575612954c6200be51eb72af8e7debce6eb617fc4839abe1eeb5a33d87210f03611004b85921801b7a96c99bb8402c06ad70e5fb15d883b77be24ed3969045ff3cf78f9345a8c949662ea9cdb240d62ae9d60a02ada31a6ff8c5e3c79e70baad324c6d706aee7a389ac852c6078cb0456073448fc7931711ea92d1fa8cda8e58519e16f56286955208a7345d4fc0dda600e1d8ecc480aa050164cd5f299e710edaa5fbbe879a7d5ac144265649e20c7d25dc3ae82d589d44d277bf5b73543b18415c025fae4be58b8e4a6e29f3f38e36198ab5170c0394820e063498bc1a818ae50023784a5d73f6d481ad1140943be8b4e219d24b995965242e5e9b8fb28401cc0987ce7c638a8589bdae0dc184903173bc30f9074cd213cff6e8057acc84ad82e0ee18598ee2585c9b77d10212e185f42b81dcea00867e0c4dec23e1ed029444ee1ee107712d6989dc49f1e0f07902a6e2c2f2c9d7a758165b264c25a955cb315ae9b87063b70d5172baa4bffddfb55bc1ac01e77dc7edf48eae885436d1fa6f1e36813997f8320925cbcbadcaac7ef4dadccf7921f934ba9d7557582f71a82878f176ca48bf793bd3af456f5bb130da63f378adda7363fe2ab93a9084ae796cac1e5e8302a05d7a578a327954ca54bba082d9dc7308203e7cd12630c8faec9c8cd5cd890c4dfea73ae5a28d75e5367bd4b37a9c22f17ef6c3c77fcce6c3f2df89b459b29db8d9e79e476827b4ef20fc26cd6ed427c58b67daafacbc8253245617853c5dfa5f18bd34da03c9bce3255c45c1627433e591b42ad505c7a6f1ad554fdb3cc96190593d6010ce6d24528ae5caed37350f9ad4de248229c96523d068c9881f54da96093388fab4ba0177b481494721e21c4595b304b041c5cf0140c5508a052377893284be1a66c8704d8f7b45095c69bd4f641447f9625be3b9e966746e1278326b5f63545b37a83e4a6b7e328baf19d4a8a83f1fab4db629f8e37d47e45e6718130e3c50e0b0b750da1efca12bd5f19a149ae05c42171d07bd2be2c2a5e55071d500c762da20e70e7efbce75699a4e23015f53749a1f410e84cfec67834b15197db2b31d1a0161d963f9cf1a61d1a24fe29b5196e9babc62cd208d0e866bbab9b353d5d5f493a03ac87cbf0b2e913fe28c6d2ef1cd961e5b47d8258fce0bbff82aba13614c259a038fa69f7f2226d622c6c4878bfba070f1361e947d99699abf8514827c3243ae69a6978c99b29f5c36ee55f01b9e75714ebf0aa56f6190b0d47492313ae5c254b744f56c572d6415b9f5957060e20c43db14826d8a3610dd8716c9406e39ea52d4f650dc397727fa1f8a81ba899080e0fe097bc667eafc02d0d1fa1ae9c46b3b95df44b52949cbcc2f06078cead934f7994b392d2322556de9dc1db0bc17efd1c976a1f6cf921f1759b68f9e4cca324068a6a774cfec23d2fdac3d3302b9f96b024f5f33dfe03125887d7bed6c57ba961042c095dd78f4e452ad5ce2ebd9631f86b778d10fd862eeb2e9e1d0a6fc256cab1754f984c8b7ad8dd1339814a44b1c0391c3bce90a5a2eb167117ddad1190c5df66f2043c8e4c48efcae52cef423556012224561dc6d91503afcef3228eed6018dfcaf11d60099bb5fab8ada1f683264640b4066c1e5c4966628bd1640ad694664aa454793f6c5b60322f5812f5f20a665fa4d5ab16b10786bf4fdc288034f76a55f1a5458cbf29018ce1ab54e5a8258b28ac51d99dd184876950edb2b9a2a4ce6a4953f3e7d4355618ac5a741a1b53518b68e367f9c12bd5de055ba1e73d39ba2ed2664e20a5172a919e3f97472708ad424d9f07f06087ba5db5cde40702353f5bca7183e57493896b9ccce2d0f1b602f4f61b1b36a9ef8ed9da934f2f67accb2aa4b76f538d4b3c3a154bac7e333eba6e5da631f16eaaedd34a83223e55990c37e2b30241f63ac641a2e97ec42e26057b58992257b34a72a5e454c79b0962290af20cbdd872744b410c2e3c5d9199e7e4cf7ddb305f326187e9d58603dc38a3c999b0e6271edff507989f93bdab0e8ecf419676e6a199c7a8abef131a04056b4fa77d6b44c2aa58cfe612016366ce61e31f8dcf3b502e0e618d9a92abf99415367ea26ae4aa18cdaa7dfe49d80417f32430bc2a3542738fad1fba7b3957cd9b77630b4475d2339769e5e9f946158d9fc8f169d8cec29dbf463a3847a55607a069a9cb4fc71e6ea75c0c521398c160298aae5e0e3fa865f402394a60314a856a95c62941711446b069e49c124d4cfe17ea979dd960c829b4361ee2eed085bea831bb5b696e21486ec1037622b8ef798f0075e1b6149a7e1185186765282533520ed82f28719cdd2040d3a2eaf99375dab61bf093ebc4a113684b7cf19327420f377c1c0855093d459b08331a37c31654de972955891234510de546b024838a7481d47e24c32f9063add59a324970062890a5c444455ac65a27c209a1eec37fae2bd43dedd8d60528c70e2f9116d140d5ca3ceac1c72e117a597ce1091f6c6a619879a9fb9790a3a5bf0631b06d43be2c3f4d0f22f67c58f2e7460d692e3e7fe3916d37f698f7c329a0f18e1df0cae22f4cba8269214ba5d7f849bf0bb63c8fcb73dea246e275fe7da05dad657c849b11d2782e22029dea25b6c585845086072ce951e5be7e78f3ba5375b62915d93201f5d1c24cc9f6dca5248ee87d25ee2ed45971f8c72ba824e9ae51fa3856de2727492af365d1602bb7fbd422d251a55f9f7f6e8a44203700dc28b3f8fb24d1e1b16cddad0e76fff710901e2b726fd0d04d37929a6a4cc3d976f4f7640adf4a8805cc1af7d5d70da13648019d353bab99111a9c639db7baa5076656fe663288ab637da8af6d4d0b378d119d94336d4e75096e7a2312dfa7231913f90f9eb42efb3aa22ef0909c30584c50af194bb573af0dd4bdb953e4a0d527d9fa4870cffc9f62021e3d7246c60524b73b843a1784e018aeef25671439195055f6929710cd30b3fb3009d7895505ab9c5bd8e6bc491f1375debda3f53635540a9fbecc99dd25cf1e5329b3801c3739f48bbd5b801d7a9caac121896a389e38b276a2803e8517b983b880376f909c2622f8b22b82dc49bced726b657a1711959c98e6701e50bc4a361d48eb0d49eb37fb0aa1c980e379136cc8471c30be6eb8130641e361e860d0c21849ae05cbd55e8e5b5c8c2f129d97defc426872b52ee209ebec96c9b086502c0b2f4e6158cd0d52e348928e7597e2e09ab004778a50d39645b7ccf783a354a197d0ad2514f831ff59aa33223ea37d0e2053b3bf2d940521eae162bbbb9b3fb39802feadaafafde9e39b37344faacb373f0c16484ceecd33e7cd9a0c575aaa5598b1ed9525b472cc3600b2047a2fc82da52ba1682cfbc4b2ce0c462a7a765f608400b3204d281c9a1709ec0b19c0b63d5649c2aa4446d82b83a9ad26634dc7572d2a42d510109682718259bdcd508b9826fe63ad6d0e3d84d05e2eb01eed1c351c956e03643dc85a221c36f7257da69b1cdbc76301043eacb134b7a3b2e46ee52e1511130c649347fb8466d190bdb942badf755729b583b08994b36b5739e7c1d26114c89e6d29b62cbd3d3b285006beb64f50856234f6c04ade6d636f2704c08ea927046e9ae1f1c1b7279dc7d1dae63b021d71fe8bec286363897eab44709705f62ac16063dd07bf1f1c0e55ccb6dc1636bab852b26154e849cebfdfb32873e7ad592180d9006ac71b3ae98261c82479aa9094b93fc76bdbd5b4e000b5d1f71d35c8d2c1794b73cc19c1bad9884a1d19d7e554f5750216e388d8e9aa7cc3d57ac89088b068fe14afbdc032067cfbb77d943f7bee60658d15099227ee814bbba1fe87b9b219aa985db71b78cf3163faf2c08aa438b8476718eeb5131cf49cf9c5cf5ce39b3af9ca6a0cb4d51d4f8e3006b87f49b145160aea7cc2ebe94a4172c3f24f05f350d77c62b5178fb41327592c38db2cda3309c29c9cdb8ef872862307a15c9a7199300062135e50dc8393cc07abd9e57326aee733a51910fd9894f230ea07e8465d1a4885f0939b1c42236cda6d69e0ef426cc8f355e8cc95a5f9c10c659713856004459c7ad84357c293c324eb25e372536f45229412be8cd6035ff527d0a48deb3e20160ff7f3847dc3f24ad0f4f567c79b35542ed57d56183ce31f1785904ff35fe5b21abc289476b303e19010dc777e9be6e14aca178cb0d194686a2a6430612c9b8dc80d0d56b6aff0e74267b4b477cc78a5a3e296ee2f91e7fba5e0d8cd54535f7005facfd4d332f243877aa02973667c7318321722e5a6bb5b488e8f5947c7888c433a903b75e2687126a0bc1430d4a8da9165367dd04844ef9a3b3f69a28d2bded293000b9e0da3ffce055d9fb046e1351ab611344b68c2e118bee54a066da96c9977a9cdb7da4ed2a541319dca0ea3dd395bead50303f5cdee36074d19f899853190111c9b64af115deafa487b204f230ade486a5b82226c4bf0937d534531fd4931da9066bd3f621298ce2f7914a2849f8da338f414c9e87592545944ce5a55713d2b4a0cf55219dad0d842b147472f80da9bdcbde99ab13ab290b677e863011c344c7955d54b3ef9ffe3a3f7cd087042a80dc227aecc25af14282d00ea9892665ebb1e394caabfe0fad64dcf6b36e749eea44b97a9acbad3102b092888153a334b38931d9c24509ac47df0bed4dd911e6a281287318466f9e052d6bec93160f5093567e1cb3b04793f73f8b009a61a94e6b0f5a798d2725bb1a098987ab0edeaefd460c37c6e7b61616f2a601058262e8460f40f2a9e4121ab358175477058f5c810fdfd5d302ea91a103a57db953560bf8983a3be6b516ef75c93787c8363825abbcbfe288acd453163ba2b3b78d616592f722459ed2969fbdf2c49c29992173ba9e55c60ef3751558196c60dc1af3e3dd2d043ce01b7b0ed563847f6e3c207c4315d70800e86d61e24e426bd0bf713dbc0227cb4ca720e9e8dcfe218e31768362c8a861af89d19a57befc9353fc768e4b4d45a1c6cc2457149c9acb41e50a372831afe9a8a3dcab087a9a40e6960044bd7e965b1058f7afef4de1c5962a59e2cc0dfc17718c6cdae95c9a2376fd5428bf864f8c8c6e0e5510cc84b0f7aab1463ba842799db5aedfbdb14ff14eec9200112b9077ed7b709f1bbb7f2e89d9b60bfc0d6d6779bc5e1debf66551e2102be2b46e146414ccb69e983b2c783b968c861cb279146bd3957cc970cda59b29e1a938f0733c10aa38b2b7b6a28d5a7114ec027e64d732c936b9a99a93aed9fd3ee0110ade9522edd6e58a39a8f5f92f3404f5a6e34f3df5ea2ab35d2599619eea14f2f8de092ed5a77699b782958ba5529ed6b27dfbb17dd0bddce07e3849d83", 0x1000}, {&(0x7f0000000580)="219f50036d2f6effc0bd238bb004932ec0c9ad3546921db4fa11f4e39e2b3e4e4004994bc5ef5b67ff91080f859450c52dbeb1f0fe8e5ea2ecac24caa54eaceee88d8e9dc8dbf6dc95b43bcad533feaa31b1a388a7dbbc9fdb3481f6c49ab9ae522dd454ae6a1804039c144e221459", 0x6f}, {&(0x7f0000000600)="2bcf717b86e1798ccf7abc0688d147075ade95a534b57e2f877e170bf39227ac8246c60adce134bc6d9e4e4e795772bf64b919ebf7642f878a479c8deff45283a23c6b05fb55dc7b80fcd696aeb43610ebb54d3ea01b", 0x56}, {&(0x7f0000000680)="46949bfeff0e0a1980d8f87f93fb762494f3b2c9d3fe2c9f454d56fe3fae4edcfa9c485c1b2db56b5f338bdb23c7b3a12ed1ae58609081cde580d8ea0a18c97d17b5be4ff1cb818e8754c3b105c5cd7fd2c9eed764728eca65e634e856fbf1f5b7eb625d9cbec1132021e3143f8dbd9d002360557242e28924ff9c1c2d8504903c33db7a367503862bb76e57e5a5cbf40232bae7d2054d1d66cd1824864b9052d299371dd4adecb8111f5f", 0xab}, {&(0x7f0000000800)="120574526eec42fbe25bba49707065fdd3ef7418e8c76793bf2021ac433afe58b69e5cc0a303578bf072622b1816a52d443719b2b109fd7f0c9abea614c60c63437553679ea0a9fbd15a59455cc0b248c5191b5c9556858aadacb0962cfe07712d12ad04c0e2e0464f56e4e9c17c315a7e2f8d5d557df16444ead99c19ed0a1907017a142fd7634eeebf0eeb5e07464b9d5bb27c91d63ead03ad60511b72944405695005b6cffcdb1d", 0xa9}], 0x8, 0x0) connect$inet6(r2, &(0x7f00000003c0)={0xa, 0x4e24, 0x8001, @mcast2, 0xae2}, 0x1c) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="28006411394d5ad5a54685c621b2432a0cd3e26ca64e0ebcb7d1ff6bf63954ba519cb574374208e8121d6a6534"]) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r3, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r3, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) sigaltstack(&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000940)) read$FUSE(r3, &(0x7f0000001000), 0x1000) [ 501.055798] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 501.076834] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:38 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000223b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:38 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xd) 14:02:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) socketpair(0x0, 0x3, 0xffff, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) mmap$xdp(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000001, 0x81010, r2, 0x0) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000240)={r3, &(0x7f00000001c0)="d947387d017ac6f253b2218b09a3331900add35a49a8135c12229e94c2c4d7aff5215de8fca21fd0b29380748fbe4d34082f791a3ee8b7f2d9ae3afcb46c605b2b53604928be19caa878929768c133d0ff26a0ccd5cc3e3a3f173fd521e5", &(0x7f00000030c0)="e58b4155cbe27c37f8ac2ab8f752098cc8951cefc6a3b0eec81c7edbd7acf0b1c8fe04c4937e1c92a44f9d08032329e7f12a2b13e7b4e3c1cb9931492b460d4f98b9fb9ff2378185ef4bfeec04b6dd07f49d8864754062c2b9ba5326dcec477338aabc7f06d018098c8ca62bb456bfa0e8b1e1f973af47400a1449a082715cfe20e3793f1ae782ed8e2157d23230161d644d5bb70c2b34e5239b2094df2a5a3767186999e241c8108cf75f535a75441fec685a6116ba54aff0b245eb5e1675fb8ad1d2f665d59861a25fd16f3dfb4db27b4d15575488c49ba796b32e7791538226954633626e03832c81d433d2410d48e3657fa91b80c3dcaeede50554032fb25be1ea3c45323c0e2e8c58bee84cfb5eac06378490c93a32d5556dcdbc4fdefaff2bc135066cd0f426e2cf2fe5d42cfd4c86a4188b9fe26007f8b63ba9ac1ffa424a7088d399fca8dae7f5c7a0b1d1bafb4850289df9a9ae989d4fbecee4fd2d5ed9874ae1a79be0f24718a9a4ce508b5d1146d66c11ea200a07a0d60318a5ae60f79c4000bafbe49bbd91da77c11f60ac813595b1af2c8856de260da22f0b34ced143081e59c0594697ae39dd25c3c0a59020fb039df05a1b6f4f9be545f395ce5a00e6e1a2233a27e2dc56b7db6973f4f001b06189e6a103b64211bad9d112b86fa83bc56c2c8df24c9d7a171f2d06058b8f32ff820543f81c7fadb9301a55806167fa700dd375fe39f688396d04dc85b52a924fa1445facc24f1d9598421cbb9503daa4617cceb24ae42b1bf1580d731969a9ecf9457f2f22963b8f4100805d96af633256485bf39f60776f79ac469b0e1f3dc60ed914e8b009da2f3f3db6463c9e1b0a1930a15ac2554710d871c5c27bc84eee929564fc7022ef56947f198961d6da5489a38e6fa810a4fa2dff96d88c0a83f4e47bc77dcd06bd218410b719a82027cd32341cd454ca2bc4803600d25735b849811b7a139abd8b262498fc6a610f26cc1ca77de6c29b04f1a4e6dc46b053749528e32d4f70835ec714da89576e301c98e37675c35a887441d0f736601326b566f952502812e17ca47256951e6f247173c892923a5870d923fd5007bddbc37db5c5bdc3274325559eae688eae58ab9068e802e7bf7e328d18e34bbd69d0ed586268fc236466795cbd6e747ea3ba4ccc17ef7c72000456687c9d89e3e5dd3fcbe3f633f648d8a4b47b9e2c0727854b656f031c08a1406ef2272a9deabd7ec12fe4444c06f6c7901296eed270f183b0cebabf87bc47cba008c48291cba02e7a617a37e9aa8726e3b950192841e14914de1df18d56ae7395a76ef33f0c0069d0bd2176e0cdb924129910c1ad94da59a1175fe5610dc12b43615976b0f60eb0377c37b73cb28487989e1c965246d3e3f0532e900d7feae04bfa1fe774870a8c04e1cbc46ccc53e9682ba34d05c507a41c450e275398e7d64cbea26832fc253e6b280e6422ae0189f3551f16931e61bec1a420d8ffe4a50399dc3107225d7faf080d194f8a069d018fec67eaf5042c120bb3c48ff5ef7001e0917beb74790a32ec4c4e1d32748e7fb10f9997f30a454cd8b0d9b66b312f3f61de21807ab2bd52189b07b462c8caf15d048a6a475980c05965906113ff51dbf3ab03eefc458a5a2c9cc7003eb6dfdd072f49c402ef624f92adb7c292dc4ae79e5233fd5fc3500186dbecf7067507b74ec4e6acaa86489f85dbd751183b900f6b237182876f0fa2a890a9f54a5e7ee41a99f5d9903a58e48b8c05db45ab5a952b92cc1c2c2bd2de67e537aa578b4cf19e6d7e2f9e8d2f2bb4d11400e040211e152cabda4ed71c3d5c66c629a26632a46172e33a659d5d35643744b6e108709c8de4fa05f2d9ceb43357cd03054e55286261f00b917acbafcba0f090c44d602675d1bd5e21561853c772ac17df1d02517e8503d28093e92fa46014e1af6cccff59d40ce99eb0e508c98d75967a93755494008c8a0e280a68e38183099b2147fd7e76e7d627b1296d18bccd8d847765ca38b01a776d9f00d727438c44723fba354684cdd2a7e8cda11a75a3ebb8dab5ef9c19f05f0487499c66f6de08ffa8b675a976ef839667050acf6a2023580f022021021243f278f3bf71624f30b2912a1eecde1c87a53069d34505c3ef86ccd23d4e7cacf45e0e75e7bc84d6c40106fee1980d60be3b9ff700e9d547f5ce996434b725ee596e2831be55bc4c283764927605bbe99331734e95b19cef8168668f093baa7b4d4cc5bdbf0861e7db83f02fa023814865939c07cf9197655d5d1837c851191fc22429fa3599d69a00b0c6f44e1020ed36cea6d15457b2c4378fb0f6bf5579eba008006fa7adea65757b1f970f31c608afe78ed81375fdd00d103922d6e9e561ddda54c33520dd4bc37cf578455bb39c8ff177d2ec247660beb801bf6c45e01bc0dded35a652f42c0f1ce81a16cdbe996b11c1d961376daa40d1ca99147a34e036dc17275e6f5fcb3323a9ebf6cc25f00e897dd31f5c39628ee7916f324d36a21f770780fb81fdc755ccd0b4709081790cb7ae0ffcc2a97cdd3a08be4da67eb90a44843f7cdcc1275f305ea8d05728a875c97ecbd94efeb29686b549ad10fb9479ce8957d922b777342dc2fbbb9c07c6a8791fa324a43f0c3f66d0e1ce0da1b1e7f2c3c8bba0a698459d7e364cf5fdf36d9a4067579b60003d67e36a56c1f35b53d32cdb368c9c68a640004d84a44f7fdd79d7b4a2fe7aed6bc3d048f97122d29929b33ea4b4668d955b705f98a8a7448334f2a88ba8cdf52ae17f46f7ca5f861c22dba7764d3857102b8500184151caba71c3f5ff33c78aa6a2923daf165a48a8941c2abde2bb77466219c7188a620a07e70684401a3ded50aa887423a7e69d5eae8955fa63e87dd5cda2c7b6b61b084a0744a89b7124e8803081bf508a81e17e93014b75f2a1b27b85f07e68c395025071498e0ee6fce5806e337ecad2696c9aedbc3d3d3b9e2f6528b1d3368c2c8239aa375d9ddee5a7fd01ff004a3748fc24b6ee0660a97b040d4665b279db6e5fed87eac3b191e89b66df02b2ee72e3576196cbffbc14e78837a1f9597012ab868dc621c18dd37b1dd10dd009892e1f9dcba33797bd04e656715cf3716b7bba8765363082d03b1ac4eaad9239b1b1c76a68ad2e27416143cda6f1d6cd5718b89554c3f430fe281170e7c0224555922cf1d2bbe16aa3e9993c06c639a26f751e0930376d30a0bab3c9877f84f0b1fdec40e55cab3ca51e6601694523cdd0d643768fd680767970c4a736d68c0e0c96d2dce6383ceafb8f9d3305684b978c0e23edf33f6d6282e39de284451e04f99da3ccdf6799a8fe6db22f082a592a4aefc378f618c0dc9a769e2c16f697e3216c2f4bf9412a32de9ba63b73ceb57090cbb054b4d3c5ebc90925583e1504b258f89478a472c6679f72b947ccc488d209171a5920e061a44ebbc67e0fedeaa7696ba72454171efae4454bb04b93098ba690f4c716ea465b3bfc1126bc413dc17f0d2ca27a28feec2376d35f6268e4de2eafa53405a91485c3a1628035895b2c8f4a740b68809e2abc9b91b8b0e80ea6e9a5110a6baa6f84691ed60500d70f33139247b832e37511e407484824f8de1d9858427074d80436e4721390e2e98c1b98305c60986a7df6c3b1c8d4d2bcd6a5505e608d4da92d3b1ec21944d698a6faaee757cc820f6a2a453e5ae3449d0c368f5ba7abb4e5ecdac23c5b02da909e7cd1318c21267f6dbb3f82f473f9b8be4d993d757a533ee9c5a30383266cf48d05fa12ad2ee7b51e3ade6abba0dd2e946d76eefae5e9ed01d44d9c5839b6004252a57384b546dc1e9ee0ecea2ba6c0c1203396eee1cf8b74bbd9caec48b14a9453c2ee8d197d05f1a604b6011e6c21f3b79ded6d1a2965ecaf7d0b12393f641bd251120607cbd0a8d19aab2a9a212fe3cc3f3ad001d18a422cfe38b962c680f297d40843dcada2412c8850744761f4497aaecd19adee6366454dfecb32f6b63190cf5fc3aa1da2ff46982740b981b8b6e33350c5b1238c9a7c1fd522b095f4012c377c5033482f13d024b7ff200b103a1570ccf08703ef3f0ae5f807e262c98dbd347c9b8d075f2291f8293dc547fe5e6f5315a71cf8a6f6e62b04292a4986c7cae46c195bb29029e5544037898fb88c1a141dffa06e5518a11d7b4d40e5fc338d0a1abada4c8395ff4200cc6064102a8d4168ec7ace07b8b8157f1800223ea3e28c62e2e822f9be52567f055f1767ba241f734341ed43f0bbb02a0f3f3471d44caf3166118cefcc8b223753defdc73725ea6b6b26e72c75f78c602939870cd64d37e65f2518ef84267149e904f6cf0b9828c9d059c7f3fe7d29997630899fb6c888db6f94d5ec4f8abc215e2d9bda955f3f7494c8533128c3e8fba77643dde5462da75c2e31c2b75717b18ed298a39bead24987bcdeb8b37deffbbd00f71a434da7b884236b780124122d412cda41e6251676ec0f650c9607040cba1faed419f69fb0754086759cb998f4d9fce7202b172944f96704dfcc47a86e850d2135b33a016bea81afd87f5de0785f91ddf233c2e8b2c56ebf385d583b9d02a6f1028cfbbfce8a12fa3bc2f83a09f212b9e18b3d1f02dc35260bbe6156daa57254a46db536cca22bf60c7dcf266ccaed6ec9de4b3aaa164fff8dc41a287a700adf401adc996e21b10305cb55e3778ccff9482c09e325c72eb18cab5df05d929b4f8a22ce86b5e24e5fb99a03342ab8e3527c5653b6f5f599f9c19ccd96ce5a9e92b7ade671457b5f99fc03c26e1295c9a526a92480fea92eb973eeb590d01354528a3b6ff31526345f20e43bcd63431ef44095f21bc1657387d1be4e23de6037e20bd1b585da2109b265532e2e45c63bd865b74c47656199cc21f2bc8fbaa46ff1e84d63947978419618b0f1ffa78e901d5c4b2307f2f2ed71efe36556e85ac25b6aaf673e843fcdcee2c9558178634aa44f72e01067ea82b9f022eefd64343c9880ab70a9395d8ec550f112a28d64352ae1bf82d3366c10800ead9b4b73acb0e9a156e965f48463d2958d071af4dbd41a09ce5b4485e8efb9bbbde0d4fc78af0e9d2bb96cc50de9276fdf02ddf6bda9020aaf4242c9f6d09150744b2d446aed5527c806841c078289c64dbf04eaad5865c9dc9752dd6c628c0ef39023974c1cd57b74e10ae024c11e3d9a5ffe79d50a235e226338c46fee285d9d0ed54393ccbdaa091dcd8b563b5fd65c7a70820cfc12776b112a19a3753bdb283b2ad6bb0a19beabe5f4a394935b8478096d1d8d3d138cd320ac1b3556f949959fecbca785ab60a9f3dc8c165e667213f692981434034290c6de2b94a4da64e9ce623b98111ebe45129186a771f756aabbe2d7601b5dc498d4b4a2a0616e92989980279a866bdd1cc1edbdb71ce9006c8e14aa0489a21c643f9b2a63449b30edc8a51c9bccd7a7058d2ace98e22b7cb4f7eac70e31909ada4bbb49fb34f5e6d135dd8268124e70bfe60ee4f5eddc0f1f9ab7f831d8b6347202b19b6c06104de0753a75f48c997fa67505738f6f675864d707b067466502855706d10ed54dc99b8abd91142495462ca9191b12cea7c261d2398e27e64814fdbf13c32450fcfca3f248cb209eb3bf5edd57a5793c713e9e964dbfa06031c3e32ce49dd14d074a3909da8171dfc74efcc735d34f9477de85620330db9cc54152c5b441ff9d2f25c137d4f3d0f640d5f715a0ff3447092d93181329777176d60a8d77f31f7492ea12397687465204ab282c4e2de436791f83", 0x2}, 0x20) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 501.138087] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 501.164395] overlayfs: './file0' not a directory 14:02:38 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0xf4ffffff) 14:02:39 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000000c500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 501.297709] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:39 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000ecf00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 501.362887] overlayfs: './file0' not a directory 14:02:39 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20004901) 14:02:39 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x9, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:39 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfe) 14:02:39 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000be700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:39 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000f2) [ 501.983185] overlayfs: './file0' not a directory 14:02:39 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000f7600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 502.007495] overlayfs: './file0' not a directory 14:02:39 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf000000) 14:02:39 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$BLKTRACESTART(r0, 0x1274, 0x0) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:39 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="e66400", @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) getpeername$unix(r0, &(0x7f00000001c0), &(0x7f0000000100)=0x6e) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=ANY=[@ANYBLOB="757365722e2fcb8fe50675080000006e2300"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:39 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000000f300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:39 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x0, 0x0) ioctl$UI_SET_PHYS(r2, 0x4008556c, &(0x7f00000001c0)='syz0\x00') read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:39 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x3f00) [ 502.192853] overlayfs: './file0' not a directory [ 502.361009] overlayfs: './file0' not a directory 14:02:40 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002c00) 14:02:40 executing program 3: setxattr$security_ima(&(0x7f0000000140)='./file1\x00', &(0x7f0000000240)='security.ima\x00', &(0x7f00000002c0)=@md5={0x1, "51555f763db51455e0f02431e132d261"}, 0x11, 0x2) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file/file1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:40 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000eea00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:40 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x4f7a020000000000) 14:02:40 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20001300) 14:02:40 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000000500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 502.798016] overlayfs: missing 'workdir' 14:02:40 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xff00) [ 502.847669] overlayfs: missing 'workdir' 14:02:40 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f00000002c0)=""/226) 14:02:40 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000110600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 502.999770] overlayfs: './file0' not a directory [ 503.030225] overlayfs: './file0' not a directory 14:02:40 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x10) 14:02:40 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="b0a652b46f50d94a3d2ecc2e696c65302c6c6f6f65726469723d2e2f66696c65312c4884726b6469723d2e2f66696c6531"]) creat(&(0x7f0000000140)='./file0\x00', 0x8000003) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x4) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') fsetxattr$security_smack_entry(r0, &(0x7f0000000080)='security.SMACK64\x00', &(0x7f0000000240)='overlay\x00', 0x8, 0x1) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:40 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vhci\x00', 0x18b482, 0x0) ioctl$EVIOCGID(r2, 0x80084502, &(0x7f0000000480)=""/111) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) r3 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x800, 0x404080) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f00000001c0)=[@in={0x2, 0x4e22, @multicast1}, @in={0x2, 0x4e21, @broadcast}, @in6={0xa, 0x4e22, 0xe53, @mcast1, 0x88}, @in={0x2, 0x4e24, @loopback}, @in6={0xa, 0x4e23, 0x4, @loopback, 0x1}, @in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x2b55702b, @empty, 0x2}, @in={0x2, 0x4e20, @loopback}, @in={0x2, 0x4e23, @remote}], 0xb4) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 503.210727] overlayfs: './file0' not a directory [ 503.218166] overlayfs: unrecognized mount option "°¦R´oPÙJ=.Ì.ile0" or missing value [ 503.265378] overlayfs: unrecognized mount option "°¦R´oPÙJ=.Ì.ile0" or missing value 14:02:41 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20006901) 14:02:41 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001bf300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:41 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffff7f00000000) 14:02:41 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000340)='./file1/file1\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:41 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000bd01) 14:02:41 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x40040, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000000000040001,user_id=\x00\x00', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x4c8) sync_file_range(r0, 0x2, 0xfff, 0x3) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x50) setxattr(&(0x7f00000003c0)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0xfffffffffffffd61, 0x82) read$FUSE(r2, &(0x7f0000001000), 0x1000) futex(&(0x7f0000000100)=0x2, 0x3, 0x1, &(0x7f00000001c0)={0x0, 0x1c9c380}, &(0x7f0000000200)=0x1, 0x1) [ 503.683556] overlayfs: './file0' not a directory [ 503.697983] overlayfs: filesystem on './file0' not supported as upperdir 14:02:41 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000154c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:41 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfbffffff00000000) 14:02:41 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000440)=ANY=[@ANYBLOB="0400000000000000060b00380cb900839c000002000000000000004a0a00000000000004000000000000004d02000000000000000400000000000000000000000000000508000000000000e91b0200000000000000d8573d2ba252162d3c6dc96b7ebf07698d21f1785fb88d246847d8a798439ee581d719b3dc96eea761b7567d897af824e1e8c1db936a15bdd0dce6ddeb195c699d2091dbeb9910f954262a83ff61b18791eb56d7e8648848cd2cf7f4519367024e9c350b47c150db47b1e4f891c8adaa549271d5de5c89714305b40f993b72139fd76fc17b5d42a991dc3888960199c80b99b4e8774f5c4af652faacd34a1c36b618e87c0c2121d9612be40c591ba596265339df14014a875e2f205dcad019cbf7b38bd098ba7720f00f050da908c0c4bbebbd464f0463bd6ecffb16f2283576dbae378fecf271a3f2633bba"]) creat(&(0x7f0000000140)='./file0\x00', 0x19f) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:41 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2ca1726f75705f69643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="78ff7fc7a87fe6aec1c8b67c722e2f4965762f8b736251f6062300"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:41 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="1b0009bfb39ab439af00708053069dcc4cda7bf0c7ceac604d4d9c640995ba8646d96350eb45bc748c00c005a1d61879975db062c5e81aca1a4e07308ef94a414af7195557981a54f41cb8e441024e8776ebf6d2630304be78c2f085d12afcee7f6df235c4133ea20fd9c182c3621a4e14f223b170d810764ed355527a013699a73dd3c9627795023a6e747059ae19450c790000000000"]) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) write$FUSE_DIRENT(r1, &(0x7f0000000800)={0x58, 0xfffffffffffffffe, 0x7, [{0x3, 0x8000000000, 0xd, 0x3, '/dev/usbmon#\x00'}, {0x3, 0x8d7d, 0x5, 0x4, 'fuse\x00'}]}, 0x58) io_setup(0x4, &(0x7f0000000400)=0x0) io_destroy(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0, 0x4) readlinkat(r3, &(0x7f0000000700)='./file0\x00', &(0x7f00000030c0)=""/4096, 0x1000) syz_mount_image$nfs4(&(0x7f0000000100)='nfs4\x00', &(0x7f00000001c0)='./file0\x00', 0x44a0accb, 0x4, &(0x7f0000000680)=[{&(0x7f0000000200)="98eb2b81e3469a9ab962039f89ff29284711234b8f5b08eed40dbc101832bab67ed4cf0f3e0d95775fec0b5bf466d6b5c0895414aad9733382c0fafda3acdb2b8e2d8272e19dbb810f94fa8da100f5f9a8027e45fd6c", 0x56, 0x6}, {&(0x7f0000000480)="db2f927942058a642d1a42629113dbcf96158925ebb37d81967a80471348def9525da9c4282f62f63dcd570b011c87bef451f02a0b67df1824e1f9004b86925e9496e81156d30bc3d335531bc07b5023da859fade304ae026565da07dc3b42928548e2fdca644a8b57c8c76a8d2a2371c317bf5cde205fe831f97d4301ceadca4c7d83f65059060a09f9005aa7fbf2e530706b967d8c5d21765a0f2ba669100a10a95f19", 0xa4, 0x6}, {&(0x7f0000000540)="a16a9b0fdafad68f0f79da0ef08f2dbcc9fcd673c1bb67e6171545b47bb117081fe09437082326390d829829ee16d96abfe270e9db0425460aa91db82c368351e44cfe0c99c270d48719d0f31566b61e506714cc23b134dea4821c04445fc8574d85a2538c22e47c1c367d67f7af3ed969870b5a2eec168f2582b3d6ef91655acf1cab2854626a1cbfd716", 0x8b, 0x8}, {&(0x7f0000000600)="7bb7f7485a4b0830ed8a95b21ae8b3931d14563fb1bae9f409c41b81b1ad8e340a2b6d3a3d2f9b96718c36f090fd2d70d903f5d13c0d69454695fb0b6b94e5b2b0801f68830ddd2c60de65f63757a08c343e0b7a8954f68b309b7e6b06a5c07586a8ac0d5cd834", 0x67, 0x3f6}], 0x100000, &(0x7f00000003c0)='fd') setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:41 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000129f00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 503.924946] overlayfs: './file0' not a directory [ 503.930920] overlayfs: './file0' not a directory 14:02:42 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf4ffffff00000000) 14:02:42 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000149) 14:02:42 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000002c0)={0x0, 0x196}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000340)={r2, @in={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xb}}}, 0x8b13, 0x4, 0x100, 0x400, 0x4}, 0x98) chdir(&(0x7f0000000140)='./file2\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x4000210004, 0x0) 14:02:42 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000009a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:42 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002500) 14:02:42 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x7b, 0x200001) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000800)=@nat={'nat\x00', 0x1b, 0x5, 0x4a8, 0x0, 0x1f0, 0x2e0, 0x0, 0x2e0, 0x410, 0x410, 0x410, 0x410, 0x410, 0x5, &(0x7f00000001c0), {[{{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x11}, 0xffffff00, 0xffffffff, 'ip6gre0\x00', 'gretap0\x00', {}, {0xff}, 0xbf, 0x1, 0x41}, 0x0, 0xe8, 0x120, 0x0, {}, [@common=@unspec=@cgroup0={0x28, 'cgroup\x00', 0x0, {0x9, 0x1}}, @common=@icmp={0x28, 'icmp\x00', 0x0, {0x10, 0x318a, 0x4, 0x1}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x1, @dev={0xac, 0x14, 0x14, 0x1c}, @multicast2, @icmp_id=0x66, @port=0x4e24}}}}, {{@ip={@local, @dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 'bridge_slave_1\x00', 'nr0\x00', {0xff}, {}, 0xec, 0x2, 0x3}, 0x0, 0x98, 0xd0}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x2, @rand_addr=0xffffffff00000001, @multicast2, @gre_key=0x3, @icmp_id=0x67}}}}, {{@uncond, 0x0, 0xb8, 0xf0, 0x0, {}, [@common=@socket0={0x20, 'socket\x00'}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x2, @empty, @multicast1, @port=0x4e23, @icmp_id=0x64}}}}, {{@ip={@loopback, @local, 0xffffffff, 0x0, 'irlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x6f, 0xb1765646f08fe739, 0x4}, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz1\x00', 0xfffffffffffff000, 0x8, 0x1, 0x1}}]}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x10, @ipv6=@ipv4={[], [], @multicast2}, @ipv6=@mcast1, @icmp_id=0x67, @gre_key=0x5}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x508) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:42 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000019500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 504.537354] overlayfs: filesystem on './file0' not supported as upperdir [ 504.547740] overlayfs: './file0' not a directory 14:02:42 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x526020000000000) 14:02:42 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f00000002c0)='./file0/file0\x00', 0x20) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x4) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:42 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000d5d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:42 executing program 5: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0x10287, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f0000001000), 0x1000) r3 = dup2(r0, r1) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r3, 0x800455d1, &(0x7f0000000100)) 14:02:42 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x4000) [ 504.775900] overlayfs: './file0' not a directory 14:02:42 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) lstat(&(0x7f00000002c0)='./file0/file1\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$security_capability(&(0x7f0000000140)='./file1/file0\x00', &(0x7f0000000240)='security.capability\x00', &(0x7f0000000380)=@v3={0x3000000, [{0xe96, 0x100000001}, {0xff, 0x1}], r0}, 0x18, 0x1) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x80000, 0x8) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 504.929101] overlayfs: './file0' not a directory [ 505.024596] overlayfs: './file0' not a directory 14:02:43 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000ca) 14:02:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001b2800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:43 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x1000000000000) [ 505.341520] __ntfs_error: 39 callbacks suppressed [ 505.341529] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:43 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002401) 14:02:43 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') r1 = geteuid() mount$9p_rdma(&(0x7f0000000140)='127.0.0.1\x00', &(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='9p\x00', 0x301000, &(0x7f0000000300)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@common=@aname={'aname', 0x3d, 'overlay\x00'}}, {@timeout={'timeout', 0x3d, 0xffffffffffff90ba}}, {@common=@aname={'aname', 0x3d, 'overlay\x00'}}, {@common=@version_L='version=9p2000.L'}, {@common=@debug={'debug', 0x3d, 0x2}}, {@rq={'rq', 0x3d, 0xffffffffffff0001}}, {@timeout={'timeout', 0x3d, 0xfffffffffffffffd}}, {@common=@posixacl='posixacl'}, {@sq={'sq', 0x3d, 0x9}}, {@sq={'sq', 0x3d, 0x3f}}], [{@defcontext={'defcontext', 0x3d, 'root'}}, {@context={'context', 0x3d, 'user_u'}}, {@fowner_eq={'fowner', 0x3d, r1}}]}}) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000017d700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:43 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x600000000000000) [ 505.491298] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 505.494206] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 505.534830] overlayfs: './file0' not a directory 14:02:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000203b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:43 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) socket$inet6(0xa, 0x1000000000001, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r1 = geteuid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000300)={{{@in=@rand_addr, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8) mount$9p_unix(&(0x7f0000000140)='./file0/file0/file0\x00', &(0x7f0000000240)='./file1/file0\x00', &(0x7f00000002c0)='9p\x00', 0x1002001, &(0x7f0000000440)={'trans=unix,', {[{@cache_mmap='cache=mmap'}], [{@fsuuid={'fsuuid', 0x3d, {[0x65, 0x0, 0x36, 0x7f, 0x0, 0x31, 0x3a, 0x7b], 0x2d, [0x32, 0x0, 0x62], 0x2d, [0x65, 0x34, 0x32, 0x62], 0x2d, [0x0, 0x65, 0x77, 0x3b], 0x2d, [0x0, 0x34, 0x77, 0x66, 0x61, 0x77, 0x77]}}}, {@hash='hash'}, {@obj_type={'obj_type', 0x3d, 'system_u:object_r:modules_dep_t:s0\x00'}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'nodev#+em1'}}, {@uid_lt={'uid<', r1}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@fowner_gt={'fowner>', r2}}]}}) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 505.668483] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:43 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f38a7d3b9643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:43 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf0ffffffffffffff) 14:02:43 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000009e700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 505.721927] ntfs: (device loop3): parse_options(): Unrecognized mount option ./file1/file0. [ 505.751785] overlayfs: './file0' not a directory [ 505.760767] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 505.840257] overlayfs: './file0' not a directory 14:02:43 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.opaque\x00', &(0x7f0000000200)='y\x00', 0x2, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r2 = dup(r0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000240)={r2, &(0x7f0000000480)="d01d69bf0e248fcaf80ba9d30f778ef5c81da501073563cb252ea0c79d93c7e079db0d8b958ecbf2dab90213d917840e79b754d4b64aa746a369bb35a97ca2bce378df2d7949fa9030b777c05a5dc61c82b63e415a311e895158c0524624918867b88d9aa3d86dad7ee5137ff0d1a711d76aab87a6811f54e00b10b8eba84df47f446230e175ed353254d15f8a3812d67b29ad4bc1ce2621979afaf02a9c75625c05d986fbbd3f45cba51d3ceedb0819fa2a500b003d4fa290142d609540be091bf3a540e3c31bb8d8d9cdd4b183a3fd0912f69931eafc5fe9df5676740f3d859d40aada73486800fd920fd291853fb2f668cee9eba40f"}, 0x10) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f00000003c0)=@known='system.advise\x00', &(0x7f0000000340)='group_id', 0xffffffffffffffcd, 0x7f193b65ef156bb6) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:43 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000b7) 14:02:43 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1001002000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 506.207820] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 506.244975] overlayfs: './file0' not a directory 14:02:44 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf0ffffffffffff) 14:02:44 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000017c) 14:02:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001a9f00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 506.252717] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:44 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') ioctl$SG_EMULATED_HOST(r0, 0x2203, &(0x7f0000000140)) truncate(&(0x7f0000000200)='./file0\x00', 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000340)=ANY=[@ANYBLOB="6d616e676c6500000000000000000000000000000000000000000000000000001f00000006000000800600000000000000000000480300001801000048030000b0050000b0050000b0050000b0050000b005000006000000", @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000441799360000000000000000000000000000000000000000000000000000000000000000"], @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f00018010000000000000000000000000000000000000000000000002800727066696c74657200000000000000000000000000000000000000000000c80000000000000028005443504d5353000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000001fe8000000000000000000000000000bbffffff00ff0000ff000000ffff000000ffffff0000000000ff0000000000000076657468305f746f5f626f6e64000000626f6e645f736c6176655f3000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff00000000000000000000000000000000bf0009070c000000000000000000000000000000c800f00000000000000000000000000000000000000000000000000028005443504d53530000000000000000000000000000000000000000000000002b1700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180140010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000002000000000000002800727066696c74657200000000000000000000000000000000000000000000000000000000000028004453435000000000000000000000000000000000000000000000000000000c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f00038010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000001000000000000004800534e50540000000000000000000000000000000000000000000000000000ff010000000000000000000000000001e00000020000000000000000000000003504f7ff00000000fe8000000000000000000000000000aa00000000000000000000000000000001ffffffff00000000ffffffffffffff00ffffffffffffffff000000ffffffffff7465616d5f736c6176655f310000000065716c00000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000003b001f0660000000000000000000000000000000f000300100000000000000000000000000000000000000000000000028006d6800000000000000000000000000000000000000000000000000000000060001000000000040005450524f58590000000000000000000000000000000000000000000000010600000005000000e00000020000000000000000000000004e200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x6e0) [ 506.312823] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000207500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:44 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x9000000) [ 506.430501] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001f4600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 506.514815] overlayfs: './file0' not a directory 14:02:44 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65306f77657264697220eb096413aa1a192c776f726b6469723d2e2f66694e65310000"]) r0 = syz_open_dev$mouse(&(0x7f0000000240)='/dev/input/mouse#\x00', 0xfaa7, 0x0) sendto$inet6(r0, &(0x7f0000000340)="13e3826ab9ae17433f4490633fd2e993cd3834e28a5d6ca1f92c9d2e65ab1457227c698483094edf5dfc4329c8a946cbb0b98d407bc89cc1670495ab35a088604503f5cff022b656eb9897b68eeafb9611d54d32b6760397f7ecb2eebb48f81a364b953ddc3c848258172a475d479816478fba5f09e6a0d3b5045fc8c5e0c77c711f717b1b3c68511843d240517e5ab0d90b38096ef48267f2b9ac52879b4336", 0xa0, 0x4, &(0x7f0000000400)={0xa, 0x4e22, 0x2, @local, 0x7f}, 0x1c) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:44 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xff000000) [ 506.659079] overlayfs: missing 'lowerdir' [ 506.669583] overlayfs: missing 'lowerdir' 14:02:44 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="280000000300000000000000001900000100000000000000070000000000000075733f725f696400c2346d2556223272478cfc7a793fdb5e865aeab0a2b0a3ab256ce8663d7c07e72771be54565009e741c7317df3c9728b53235930d9ec5c27ac0d393173b7c93be74ca39d77d7ea4890a14c9448aa1904742d33cfd3e85720beba764b0935ac1e5d9fdfd285f3b27d4f5e60aa72de4a2fb78872e363061df459e1d7f25ee44c62111447d759e4947469822a2067b4a4ce13837452f0f5ce0f45664e76fd806ea8"], 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000171900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:44 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000240)='./file1/file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:44 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x3f000000) 14:02:44 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000b6) 14:02:44 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20009701) 14:02:44 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="7570693e29d859fcbc631a88e8507a000000800000e1ff2e66696c65302c6c6f7765726469723d2e2f66696c65312c776f"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:44 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000017e500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:44 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x20000) 14:02:45 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000106600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:45 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75707065723190723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65312c776f726b6469723d2e2f66696c6531"]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000140)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$VHOST_SET_VRING_NUM(r0, 0x4008af10, &(0x7f00000002c0)={0x3, 0x100000000}) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) fanotify_mark(r0, 0x80, 0x10, r0, &(0x7f0000000240)='./file0/file0\x00') [ 507.253449] overlayfs: unrecognized mount option "upi>)ØYü¼cˆèPz" or missing value [ 507.273226] overlayfs: unrecognized mount option "upi>)ØYü¼cˆèPz" or missing value [ 507.379499] overlayfs: './file0' not a directory 14:02:45 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xa) [ 507.404112] overlayfs: unrecognized mount option "upper1r=./file0" or missing value [ 507.439086] overlayfs: unrecognized mount option "upper1r=./file0" or missing value [ 507.534932] overlayfs: './file0' not a directory 14:02:45 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000000a000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:45 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='\b\x00\x00\x00rdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:45 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x7) 14:02:45 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000200)=ANY=[@ANYBLOB="280000000300000000000000000000000100000000000000070000000000be2f757365725f69640085626849d4d991420468cbae05decb71c4fadb0e269cd91f3f318dc6fe6f46079da27aa32093023dfd0dfc661f4ea4c7a58d"], 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 507.967630] overlayfs: unrecognized mount option "" or missing value [ 507.994524] overlayfs: unrecognized mount option "" or missing value [ 508.011483] overlayfs: './file0' not a directory 14:02:45 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20009901) 14:02:45 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001ffb00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:45 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000d00) 14:02:45 executing program 3: mkdir(&(0x7f0000000140)='./file0\x00', 0xfffffffffffffffe) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') fadvise64(r0, 0x0, 0x10001, 0x0) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:45 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xc000000000000000) [ 508.179686] overlayfs: './file0' not a directory 14:02:46 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000160e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:46 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000400), &(0x7f0000000440)=0x4) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f00000003c0)) chdir(&(0x7f0000000280)='./file0\x00') setsockopt$inet6_int(r1, 0x29, 0x0, &(0x7f0000000140)=0x9fc, 0x4) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000380)=0x6e) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000240)={@mcast2}, &(0x7f00000002c0)=0x14) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 508.247982] overlayfs: './file0' not a directory 14:02:46 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x1400000000000000) 14:02:46 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000172d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 508.380141] overlayfs: './file0' not a directory 14:02:46 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000140)) 14:02:46 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xe4ffffff) [ 508.545012] overlayfs: './file0' not a directory 14:02:46 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x2200, 0x0) memfd_create(&(0x7f00000001c0)='\x00', 0x69a0771b7d0232b5) syz_open_dev$dmmidi(&(0x7f0000000200)='/dev/dmmidi#\x00', 0x200000000000000, 0x103) r2 = dup3(r1, r0, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r3, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r3, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=ANY=[@ANYBLOB='user./d/usbmo\b#\x00\x00\x00'], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r3, &(0x7f0000001000), 0x1000) 14:02:46 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000170) 14:02:46 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000000a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:46 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f00000009c0)=[@in6={0xa, 0x4e24, 0x101, @mcast1, 0x8}, @in6={0xa, 0x4e21, 0x100, @dev={0xfe, 0x80, [], 0xc}}, @in6={0xa, 0x4e21, 0x0, @empty, 0x80000000}, @in6={0xa, 0x4e22, 0x8, @remote, 0xfffffffffffffe00}, @in6={0xa, 0x4e20, 0x8, @mcast2, 0x9000000}], 0x8c) chdir(&(0x7f0000000280)='./file0\x00') recvmsg$kcm(r0, &(0x7f0000000140)={&(0x7f00000002c0)=@pptp={0x18, 0x2, {0x0, @remote}}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000340)=""/106, 0x6a}, {&(0x7f00000003c0)=""/130, 0x82}, {&(0x7f0000000480)=""/194, 0xc2}, {&(0x7f0000000580)=""/232, 0xe8}, {&(0x7f0000000680)=""/217, 0xd9}, {&(0x7f0000000780)=""/142, 0x8e}], 0x6, &(0x7f00000008c0)=""/209, 0xd1, 0x3ff}, 0x10040) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:46 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x8cffffff00000000) 14:02:46 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001a6) 14:02:46 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000003fb00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 509.087249] overlayfs: './file0' not a directory [ 509.097198] overlayfs: './file0' not a directory 14:02:46 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x5000000) 14:02:46 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) dup2(r0, r1) recvmsg(r1, &(0x7f0000000140)={&(0x7f0000000340)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/131, 0x83}, {&(0x7f0000000480)=""/74, 0x4a}, {&(0x7f0000000500)=""/240, 0xf0}, {&(0x7f0000000b80)=""/4096, 0x1000}, {&(0x7f0000000600)=""/124, 0x7c}, {&(0x7f0000000680)=""/137, 0x89}], 0x6, &(0x7f00000007c0)=""/206, 0xce, 0x10001}, 0x40002000) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") fstat(r1, &(0x7f00000002c0)) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:47 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000014aa00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 509.413851] overlayfs: './file0' not a directory [ 509.433145] overlayfs: './file0' not a directory 14:02:47 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75df070000000000002e2f66296c65302c6c6f0000726469723d2e2f66696c65312c776f726b6469723d2e2f66696c6531"]) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000140)={0xffffffffffffffff}) r1 = accept(r0, &(0x7f00000002c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000240)=0x80) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)="6a797374656d5f753a6f626a6563745f723a73755f657865635f063a733000", 0x1f, 0x0) r3 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r3, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000340)=@assoc_value={0x0, 0x8}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f00000003c0)=@sack_info={r4, 0x0, 0x610}, &(0x7f0000000400)=0xc) 14:02:47 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001b6100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 509.591126] overlayfs: unrecognized mount option "uß" or missing value [ 509.624117] overlayfs: unrecognized mount option "uß" or missing value 14:02:47 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=ANY=[@ANYBLOB="75736572132f6465762f7573626d6f6e2300"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:47 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x8) 14:02:47 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000010df00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:47 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000049) 14:02:47 executing program 3: r0 = socket(0x11, 0x4, 0x94) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000240), 0x4) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r1 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000140)={0xf, 0x1f, 0x1, 0x3}, 0xf) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 509.784390] overlayfs: './file0' not a directory [ 509.800512] overlayfs: './file0' not a directory 14:02:47 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000005c) 14:02:47 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000022900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:47 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffffffffffff7f) 14:02:47 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) mkdir(&(0x7f0000000140)='./file1\x00', 0x12) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f00000003c0)=0xe8) fstat(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000240)='./file0/file0\x00', r2, r3) [ 509.917028] device bridge_slave_1 left promiscuous mode [ 509.923098] bridge0: port 2(bridge_slave_1) entered disabled state [ 509.949919] device bridge_slave_0 left promiscuous mode [ 509.963079] IPVS: ftp: loaded support on port[0] = 21 [ 509.980698] bridge0: port 1(bridge_slave_0) entered disabled state [ 510.042594] team0 (unregistering): Port device team_slave_1 removed [ 510.057545] team0 (unregistering): Port device team_slave_0 removed [ 510.069964] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 510.083441] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 510.106707] bond0 (unregistering): Released all slaves 14:02:47 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001e1300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 510.129973] overlayfs: './file0' not a directory [ 510.135556] overlayfs: './file0' not a directory 14:02:47 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowevdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x20000000000) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:47 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x10000000) [ 510.353238] overlayfs: unrecognized mount option "lowevdir=./file1" or missing value [ 510.374055] overlayfs: unrecognized mount option "lowevdir=./file1" or missing value [ 510.394521] __ntfs_error: 43 callbacks suppressed [ 510.394529] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:48 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000040c0), 0xfffffffffffffdd2) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000003c0)=0x0) ioctl(r0, 0x97f, &(0x7f00000005c0)="b987d4a0ce1504910bb438694389d1a6a3a2e440fd51cae0e93960c4c67d45bb31b1babb942becd3ab67931490d59b702cdd6e1dd2f7b11e3d48c2103562683162ce2859ac9c4d3800e92fa1f5c204f88243e70127742a34249f78") fcntl$setownex(r1, 0xf, &(0x7f0000000580)={0x2, r2}) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) r3 = geteuid() r4 = getegid() mount$fuseblk(&(0x7f0000000100)='/dev/loop0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='fuseblk\x00', 0x10000, &(0x7f0000000480)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@max_read={'max_read', 0x3d, 0xffffffffffffff81}}], [{@fsuuid={'fsuuid', 0x3d, {[0x61, 0x31, 0x62, 0x0, 0x77, 0x73, 0x77, 0x65], 0x2d, [0x66, 0x77, 0x0, 0x73], 0x2d, [0x30, 0x63, 0x35, 0x32], 0x2d, [0x34, 0x73, 0x7b, 0x36], 0x2d, [0x77, 0x0, 0x39, 0xec8dee871e587433, 0x66, 0x33, 0x3d]}}}, {@audit='audit'}, {@smackfsfloor={'smackfsfloor', 0x3d, '/dev/usbmon#\x00'}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@obj_role={'obj_role'}}, {@seclabel='seclabel'}]}}) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="75e5e6a7b0fe1647627365722e2f6465762f7573626d6f"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:48 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000cb900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:48 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xff0f0000) [ 510.628365] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 511.090437] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.096936] bridge0: port 1(bridge_slave_0) entered disabled state [ 511.103728] device bridge_slave_0 entered promiscuous mode [ 511.127740] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.134104] bridge0: port 2(bridge_slave_1) entered disabled state [ 511.141135] device bridge_slave_1 entered promiscuous mode [ 511.163741] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 511.187621] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 511.249997] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 511.275190] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 511.374082] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 511.381225] team0: Port device team_slave_0 added [ 511.403549] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 511.410930] team0: Port device team_slave_1 added [ 511.443937] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 511.478471] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 511.502527] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 511.525608] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 511.720783] bridge0: port 2(bridge_slave_1) entered blocking state [ 511.727151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 511.733702] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.740070] bridge0: port 1(bridge_slave_0) entered forwarding state [ 511.747368] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 512.440499] 8021q: adding VLAN 0 to HW filter on device bond0 [ 512.509639] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 512.566504] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 512.582811] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 512.589033] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 512.595858] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 512.665898] 8021q: adding VLAN 0 to HW filter on device team0 14:02:51 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000135) 14:02:51 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x408000, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000300)={0x6}, 0x4) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') r2 = add_key(&(0x7f0000000140)='rxrpc_s\x00', &(0x7f0000000240)={'syz', 0x2}, 0x0, 0x0, 0x0) keyctl$assume_authority(0x10, r2) fchmod(r1, 0xa0) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:51 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001d0a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:51 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000f201) 14:02:51 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x40000) 14:02:51 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x40840, 0x0) getdents64(r2, &(0x7f0000000580)=""/189, 0xbd) read$FUSE(r1, &(0x7f00000020c0), 0x1000) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f00000003c0)=0xc) getresgid(&(0x7f0000000640), &(0x7f0000000680), &(0x7f00000006c0)=0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000800)={0xb8, 0x0, 0x3, [{{0x3, 0x3, 0x6, 0x1, 0x6, 0x0, {0x3, 0x1, 0x9a2f, 0x5, 0x10000, 0x9, 0x5, 0x5, 0x6, 0x2, 0x1, r3, r4, 0x0, 0x800}}, {0x2, 0x4, 0xa, 0xffffffffffffe40f, '/dev/fuse\x00'}}]}, 0xb8) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x620481, 0x0) statx(r5, &(0x7f00000001c0)='./file0\x00', 0x0, 0x200, &(0x7f0000000480)) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 513.921783] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 513.934955] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:51 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000019c700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:51 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65312c776f726b6469723d2e2f66696c6531c0f77cc91517d00f1d086ddf43e3c2f8dd3dd35e0d3cbd60e1106e40befe66d4b5e730bb264b25dd69bfcb3290a39d2e75f63b30d299612a2b650c136599976d822b93ac82518df7e29fae8079e176dd33686a75926a0bde540cfe3dccf2927041d7ac82de5923c6ad6d76b0ebe7c9801263cf98da4337557ce08c32a0228fbde4985d335b175afc426e7f1e3c46af850218bffe3aa26b066a830ffd43fcd3dcf681e76037e9da6a7c8baa35f0a9365e398fff85f7291448a5945bf2e396be1e1bcdec7fdc0efd"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0xb225, &(0x7f0000000280)="153f62c457b8b971a513b7") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x18, 0x2f, 0x829, 0x0, 0x0, {0x2801}, [@nested={0x4}]}, 0x18}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f00000005c0)=@add_del={0x2, &(0x7f0000000180)='erspan0\x00', 0xb2}) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="66643d735f900e9893c473e7ab837db2ed4a5e229b8f8c00cddd8a64275b8ef7d00e5eb3423e0485f6d5", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000480)='/dev/null\x00', 0x10000, 0x0) ioctl$KDGKBTYPE(r4, 0x4b33, &(0x7f00000004c0)) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000500)=ANY=[@ANYBLOB="28000003000000000000000000000001000000000000000700000000000000757365725f696400a979b63caa088c253f30ed87d483f9769bd9db938aa064c8ea9f6a44f85405eb6b0f5ce7decfc3c284969dd9aa8d28fcbda724c2a1b3edd4ccafe7f4c99808e45dec223dc514b5eac20f411beebf36dcff8a6139cab17c53646e1208584a75bfa1d0b3"], 0x28) read$FUSE(r3, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r3, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000240)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f00000001c0)="6c6f9300", 0x4, 0x0) ioctl$UI_BEGIN_FF_ERASE(r3, 0xc00c55ca, &(0x7f0000000100)={0x5, 0x30000000000000}) read$FUSE(r3, &(0x7f0000001000), 0x1000) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) utimes(&(0x7f0000000080)='./file0\x00', &(0x7f00000003c0)={{r5, r6/1000+10000}, {0x0, 0x7530}}) [ 514.007603] overlayfs: './file0' not a directory [ 514.020418] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. [ 514.042695] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:51 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001b4b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:51 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xc0000000) [ 514.087645] overlayfs: failed to resolve './file1À÷|ÉÐmßCãÂøÝ=Ó^ <½`án@¾þfÔµç0»&K%Ýi¿Ë2£.uö;0Ò™a*+e e™—m‚+“¬‚Q÷⟮€yávÝ3hju’j ÞT þ=Ìò’pA׬‚ÞY#Æ­mv°ëçÉ€cϘÚC7U|àŒ2 "½ä˜]3[ZüBn0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000009c900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:52 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20007a00) 14:02:52 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000100)=0x0) tkill(r2, 0x1c) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:52 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x800000) 14:02:52 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') statfs(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=""/54) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)=0x100000000) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:52 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20009201) 14:02:52 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001cd500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 514.832132] overlayfs: './file0' not a directory [ 514.845113] overlayfs: './file0' not a directory 14:02:52 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) syz_mount_image$iso9660(&(0x7f0000000200)='iso9660\x00', &(0x7f0000000240)='./file1/file0\x00', 0xbb2e, 0x0, &(0x7f00000002c0), 0x40, &(0x7f0000000300)={[{@nocompress='nocompress'}, {@cruft='cruft'}], [{@context={'context', 0x3d, 'root'}}, {@subj_user={'subj_user', 0x3d, 'security.selinux\x00'}}, {@audit='audit'}, {@subj_user={'subj_user', 0x3d, 'overlay\x00'}}, {@fsname={'fsname'}}, {@fsmagic={'fsmagic', 0x3d, 0x47}}, {@subj_user={'subj_user', 0x3d, '\'/-vmnet1'}}, {@smackfsfloor={'smackfsfloor'}}]}) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000140)='./file0\x00', 0x9) 14:02:52 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x8008) 14:02:52 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000019c200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:52 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001f3f00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 515.060241] overlayfs: './file0' not a directory [ 515.065092] overlayfs: './file0' not a directory 14:02:52 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c651ffa776f726b6469723d2e2f66696c6531"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:52 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf0) [ 515.248253] overlayfs: missing 'workdir' [ 515.260229] overlayfs: missing 'workdir' [ 515.268194] overlayfs: './file0' not a directory 14:02:53 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000ce01) 14:02:53 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001d6e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:53 executing program 3: syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r0, 0xc008551b, &(0x7f00000003c0)={0x2, 0xc, [0x9, 0x5, 0x800]}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f00000002c0)=0xfffffffffffffe90) mount$overlay(0x0, &(0x7f0000000140)='./file1/file0\x00', &(0x7f0000000180)='overlay\x00', 0x80000, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@metacopy_off='metacopy=off'}], [{@dont_appraise='dont_appraise'}, {@euid_gt={'euid>', r2}}, {@fsuuid={'fsuuid', 0x3d, {[0x3b, 0x64, 0x7d, 0x36, 0x77, 0x33, 0x30, 0x37], 0x2d, [0x63, 0x37, 0x33, 0x77], 0x2d, [0x39, 0x32, 0x63], 0x2d, [0x37, 0x77, 0x77], 0x2d, [0x66, 0x38, 0x61, 0x3f, 0x62, 0x77, 0x32, 0x3b]}}}, {@appraise='appraise'}, {@hash='hash'}, {@subj_user={'subj_user'}}]}) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:53 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x22605) 14:02:53 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='gd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x80001, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f00000001c0)) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000140)=0x6) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f0000000200)='fuse\x00') 14:02:53 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20004900) 14:02:53 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r0, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 515.670859] __ntfs_error: 13 callbacks suppressed [ 515.670891] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 515.692236] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:53 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000004a800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:53 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfffffffffffff000) [ 515.744667] overlayfs: './file0' not a directory [ 515.753356] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. 14:02:53 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000d0a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 515.798008] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:53 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") getpeername$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000240)=0x14) dup3(r0, r1, 0x0) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 515.924504] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 515.953716] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:53 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000192900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 515.985728] overlayfs: './file0' not a directory [ 516.002403] ntfs: (device loop3): parse_options(): Unrecognized mount option . [ 516.017298] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. [ 516.026980] overlayfs: './file0' not a directory 14:02:54 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000ff00) 14:02:54 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0xfffffffffffffff7, &(0x7f00000002c0)="0000120000f06db8f63f2b659975088dcff6f7197dac6700") chdir(&(0x7f0000000280)='./file0\x00') time(&(0x7f0000000140)) unlink(&(0x7f0000000240)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:54 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x2000) 14:02:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000123300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:54 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000fb00) [ 516.504557] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 516.506893] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:02:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000229f00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 516.581973] overlayfs: './file0' not a directory [ 516.601385] overlayfs: filesystem on './file0' not supported as upperdir 14:02:54 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f00000002c0)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x1000000000000000, &(0x7f0000000100)=ANY=[]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000340)=0xc) sendmsg$kcm(r0, &(0x7f00000007c0)={&(0x7f0000000440)=@in={0x2, 0x4e24}, 0x80, &(0x7f0000000780)=[{&(0x7f00000004c0)="fd2547d6479bab5495e649e07d64be788677f84b08efa1d4e7edb5ed57dc53ec94cb26eac66b7c0de4b34b807dd34eb440f9b8627779e9b9b0c3ef2cf148dc4316cd888e4a7a7184407110a9facccf6eb3daf4b004113de997b820ba535f605d78dd2df1baf7a651288e58565854c69b298ea120133d7d579c64ecdf6f32599aed240d06f6806f511c287686b912e698cee4d57adcb12c6cfaaabe2cad3b159716945e52b7330358a2719f9000ea045a0a554e548156e72d1a", 0xb9}, {&(0x7f0000000580)="d7526cc9529ab87e877b8d787883ef561dc1075108d630b39848762174dd7b72ceb6082896d04b9a60ac1474e464f3b19a737ebec7de2d4d825f97c41ce822a8a48629fb7e0a5067af23bde4b9630b2ea5e25823580e81f8ef67a4db9c1ad892202ca497167f54a70c5cb1fb287ef45f6c780699333961b321e8f8363cc0d47bf8a67fd99dfabb1f33642727a9fe4d567fa4dcef13d302b8dbf8225f14bdb7b55270f094c1175e1c9aede225b889ccbef3f90a2f9db89ee7eee4d1cbc6f7c4323e902e411ea6a78ccd4834595eeb0821890a7cbf861610a240fcac59e7b67bbde927cbd8d7fa4a6f8ee494", 0xeb}, {&(0x7f0000000680)="5d4d899c4846c25756cf46581e7b9e8dc17689b0c7d3a6710f0c3c396ef4a22366a9e2cf6cea754e98423a76d4d81aa18e2503729f193e013ceb3398dd05ffd7ae474f50a12fcc5276ebefd870ce8205f3f6d23ab04740b8d814a8cdd5a28193f9c14c0dbf752d6bb54a0a3de125b7e0c85111ff8b0818b8916f042bfbbd3c188aeb12799708fe67fe51e78be1b50361a11a733c06fb8869ad925efa9d3d74d276f30da6b50488a67886e2f3eb8e1777c73a5bc95dd9145aa94953864db7465d9d351a11e9770cb963660c3cc1ca126e76249a47e59ffac3a3", 0xd9}, {&(0x7f00000002c0)}], 0x4, &(0x7f0000000b80)=[{0x30, 0x0, 0x8000, "05b702e41d4e17f96a664d928d0fa55a1db281eccaf75f768ab9967fb3cb"}, {0x60, 0x1ff, 0x9, "10c7edaa4609f6e31aca504cf1624792224aba910b598f02d6dc3c695a0e83558fc2aac7f10090284838ea0a6efe147c199d5f04d8afbe045c8264e8b8c32ba52e1ff331123f2296f4"}, {0x110, 0x10c, 0x1000, "f07b5b7fd114b9d61110e6ea3cc698b559a8a737e512195093df496c29b77a4c709ab78b58a11ba12ed849025ffdfcffc61af6123b8df2facddab6b730f1f5bfb926967b1a7a37a2330ed90d27a9a0d8a4f223a66d1db4edb6e7955398b1f762e9d21ef0bd62bea8fff660606fc3be37e94906cde39ca0e018d85c77c44d4ba12d76538d71e98666e369f6f63b832ddfabe26aa4979e465560658fc780533f1195a982acb2e67b4e589711e8453b64f185b5b75787aab7199779c2d737f498b8713ece2822abf9926b9709d4606b7e13eff662b18be058fbf0701e26968b6f03afa77c4e116f03c3e16948840afd32927db10d0b8df9cbabaa0f19"}, {0xb8, 0x0, 0xc6, "a8ab3a2cac9c4a94d9859e13e20561a081a34c60a92825b39b70d0fb37cc3a57b2328f951b34a0c1947f4c4749fedaa9424a6d804f35f1376dca82cb0eece5753e393b85b3ca5ffdc798414d1f58c7283aacd09fc42418658ac59085ba74b76ca8bc066e780558c4adb59e025c090337f9c7a667f5b148fba5733a4bea21411fa29c698286eed5beea881600ec479a179e8aee89e17dd92f6ebbf623aaa5ff61fc1f6abb"}, {0x58, 0x3a, 0x6, "b7c6c3cff25a12fa78f581fc2e04f32cdcf2ce8f57145b1c272aa3e64e3783b6102faff068cc42a028d9176e62313e0e5c1bf12deb88ff157943480c5bcea607f2d9cb068376ad"}, {0xc8, 0x101, 0x7, "78f28ccf9a582ac1d9318477c5821b6270f0990d82becfe60425e5de2d15b8e19d09dbb1d0b538ebcf7b8c7161237f0425622131a31134d1ffc66c2f0b4ba5813f91fb0d98267e54e568800aa46102cdbc0af9d6cb930d35eff8b7139cccf06d80ff4cbdb78a01ebb01be46e37bd9f87d0bd3c9b4fdba1bdd3101d4f568eb5ab1ed828a0ef6954af45fa6b8e315d26af331a6f771f39b6e0cb7ea3aead7b07c2d1b9d199c7960927790713ae1ac917c3b34fb206000fa78b"}, {0x98, 0xff, 0x1, "6ccfe9ba736a3bb3b9e6780bc10f7893afa82f70d2e074754413c48b1027f9b615d3d2c339dcab07f719449ce2a5fa61478e5118c796cc835aa2055053b9d954195f1a88965ad26ac85013356fcb69709189069272901e5a92a3c245eda4c65b025b3017561e3b641815dc41dea1993a99fa4bd0f64bc35ad32a34edaf35ef08e8438a7928"}], 0x410, 0xc0}, 0x0) syz_mount_image$reiserfs(&(0x7f0000000140)='reiserfs\x00', &(0x7f0000000240)='./file1/file0\x00', 0xffffffff, 0x0, &(0x7f00000002c0), 0x4000, &(0x7f0000000380)={[{@jdev={'jdev', 0x3d, './file0/file0'}}, {@usrquota='usrquota'}], [{@fsname={'fsname', 0x3d, 'system_u:object_r:modules_dep_t:s0\x00'}}, {@appraise='appraise'}, {@uid_lt={'uid<', r2}}, {@fsmagic={'fsmagic'}}, {@seclabel='seclabel'}, {@smackfsroot={'smackfsroot', 0x3d, 'system_u:object_r:modules_dep_t:s0\x00'}}]}) 14:02:54 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfffff000) 14:02:54 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x8000, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') accept4$packet(0xffffffffffffff9c, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000480)=0x14, 0x80800) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000004c0)={0x0, @rand_addr, @remote}, &(0x7f0000000500)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000540)={'vcan0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000580)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000680)=0xe8) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1d, &(0x7f00000006c0)={@loopback, 0x0}, &(0x7f0000000700)=0x14) accept(r1, &(0x7f00000008c0)=@can={0x1d, 0x0}, &(0x7f0000000940)=0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000b40)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000c00)={'team0\x00', 0x0}) accept4$packet(0xffffffffffffff9c, &(0x7f0000000c40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000c80)=0x14, 0x80000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000d80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000dc0)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000e00)={'bcsh0\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000003340)={{{@in6=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@remote}}, &(0x7f0000003440)=0xe8) recvmmsg(r1, &(0x7f0000005a80)=[{{0x0, 0x0, &(0x7f0000003680)=[{&(0x7f0000003540)=""/39, 0x27}, {&(0x7f0000003580)=""/181, 0xb5}, {&(0x7f0000003640)=""/19, 0x13}], 0x3, &(0x7f00000036c0)=""/83, 0x53, 0xffff}, 0xe}, {{&(0x7f0000003740)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000003c00)=[{&(0x7f00000037c0)=""/94, 0x5e}, {&(0x7f0000003840)=""/175, 0xaf}, {&(0x7f0000003900)=""/119, 0x77}, {&(0x7f0000003980)=""/122, 0x7a}, {&(0x7f0000003a00)=""/23, 0x17}, {&(0x7f0000003a40)=""/131, 0x83}, {&(0x7f0000003b00)=""/57, 0x39}, {&(0x7f0000003b40)=""/154, 0x9a}], 0x8, &(0x7f0000003c80)=""/30, 0x1e, 0x1}}, {{&(0x7f0000003cc0)=@ipx, 0x80, &(0x7f0000004200)=[{&(0x7f0000003d40)=""/199, 0xc7}, {&(0x7f0000003e40)=""/197, 0xc5}, {&(0x7f0000003f40)=""/229, 0xe5}, {&(0x7f0000004040)=""/198, 0xc6}, {&(0x7f0000004140)=""/149, 0x95}], 0x5, 0x0, 0x0, 0x8001}, 0x1}, {{&(0x7f0000004280)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000005780)=[{&(0x7f0000004300)=""/161, 0xa1}, {&(0x7f00000043c0)=""/229, 0xe5}, {&(0x7f00000044c0)=""/43, 0x2b}, {&(0x7f0000004500)=""/89, 0x59}, {&(0x7f0000004580)=""/180, 0xb4}, {&(0x7f0000004640)=""/8, 0x8}, {&(0x7f0000004680)=""/48, 0x30}, {&(0x7f00000046c0)=""/140, 0x8c}, {&(0x7f0000004780)=""/4096, 0x1000}], 0x9, &(0x7f0000005840)=""/12, 0xc}, 0xffffffffffff5a3d}, {{&(0x7f0000005880)=@in6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f0000005a00)=[{&(0x7f0000005900)=""/86, 0x56}, {&(0x7f0000005980)=""/94, 0x5e}], 0x2, &(0x7f0000005a40)=""/21, 0x15, 0x3}, 0x7}], 0x5, 0x10000, &(0x7f0000005bc0)={0x77359400}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000006dc0)={{{@in=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000006ec0)=0xe8) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000006fc0)={@empty, 0x0}, &(0x7f0000007000)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000007040)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@mcast2}}, &(0x7f0000007140)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000007240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000007280)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000072c0)={{{@in6=@remote, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast1}}, &(0x7f00000073c0)=0xe8) getpeername$packet(0xffffffffffffffff, &(0x7f0000007400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000007440)=0x14) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000007540)={@loopback, @dev, 0x0}, &(0x7f0000007580)=0xc) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000007f80)={0x0, @loopback, @multicast2}, &(0x7f0000007fc0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000080c0)={{{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}}}, &(0x7f00000081c0)=0xe8) getpeername(r0, &(0x7f0000008240)=@can={0x1d, 0x0}, &(0x7f00000082c0)=0x80) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000008300)={'syzkaller0\x00', 0x0}) clock_gettime(0x0, &(0x7f000000d2c0)={0x0, 0x0}) recvmmsg(r0, &(0x7f000000d100)=[{{&(0x7f0000008340)=@nfc_llcp, 0x80, &(0x7f0000008500)=[{&(0x7f00000083c0)=""/49, 0x31}, {&(0x7f0000008400)=""/201, 0xc9}], 0x2, &(0x7f0000008540)=""/4096, 0x1000, 0x80}, 0x80}, {{&(0x7f0000009540)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000009800)=[{&(0x7f00000095c0)=""/118, 0x76}, {&(0x7f0000009640)=""/214, 0xd6}, {&(0x7f0000009740)=""/139, 0x8b}], 0x3, &(0x7f0000009840)=""/55, 0x37, 0xffffffff}, 0x7fff}, {{&(0x7f0000009880)=@vsock, 0x80, &(0x7f0000009c00)=[{&(0x7f0000009900)=""/109, 0x6d}, {&(0x7f0000009980)=""/98, 0x62}, {&(0x7f0000009a00)=""/39, 0x27}, {&(0x7f0000009a40)}, {&(0x7f0000009a80)=""/149, 0x95}, {&(0x7f0000009b40)=""/73, 0x49}, {&(0x7f0000009bc0)=""/25, 0x19}], 0x7, &(0x7f0000009c80)=""/126, 0x7e, 0x80}, 0x22}, {{&(0x7f0000009d00)=@in={0x2, 0x0, @remote}, 0x80, &(0x7f000000b200)=[{&(0x7f0000009d80)=""/160, 0xa0}, {&(0x7f0000009e40)=""/191, 0xbf}, {&(0x7f0000009f00)=""/86, 0x56}, {&(0x7f0000009f80)=""/119, 0x77}, {&(0x7f000000a000)=""/4096, 0x1000}, {&(0x7f000000b000)=""/15, 0xf}, {&(0x7f000000b040)=""/156, 0x9c}, {&(0x7f000000b100)=""/249, 0xf9}], 0x8, &(0x7f000000b280)=""/180, 0xb4, 0x2}, 0x1}, {{&(0x7f000000b340)=@rc, 0x80, &(0x7f000000b900)=[{&(0x7f000000b3c0)=""/129, 0x81}, {&(0x7f000000b480)=""/21, 0x15}, {&(0x7f000000b4c0)=""/74, 0x4a}, {&(0x7f000000b540)=""/227, 0xe3}, {&(0x7f000000b640)=""/114, 0x72}, {&(0x7f000000b6c0)=""/73, 0x49}, {&(0x7f000000b740)=""/64, 0x40}, {&(0x7f000000b780)=""/104, 0x68}, {&(0x7f000000b800)=""/175, 0xaf}, {&(0x7f000000b8c0)=""/62, 0x3e}], 0xa, &(0x7f000000b9c0)=""/136, 0x88, 0x8}, 0x8}, {{&(0x7f000000ba80)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f000000bbc0)=[{&(0x7f000000bb00)=""/185, 0xb9}], 0x1, &(0x7f000000bc00)=""/34, 0x22, 0x8e}, 0x20}, {{&(0x7f000000bc40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f000000d080)=[{&(0x7f000000bcc0)=""/24, 0x18}, {&(0x7f000000bd00)=""/135, 0x87}, {&(0x7f000000bdc0)=""/11, 0xb}, {&(0x7f000000be00)=""/253, 0xfd}, {&(0x7f000000bf00)=""/74, 0x4a}, {&(0x7f000000bf80)=""/245, 0xf5}, {&(0x7f000000c080)=""/4096, 0x1000}], 0x7, 0x0, 0x0, 0x7}, 0xffffffffffff8001}], 0x7, 0x40000040, &(0x7f000000d300)={r28, r29+10000000}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f000000d780)={{{@in6=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}}}, &(0x7f000000d880)=0xe8) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f000000d8c0)={@mcast1, 0x0}, &(0x7f000000d900)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f000000d940)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@local}}, &(0x7f000000da40)=0xe8) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x14, &(0x7f000000da80)={@local, 0x0}, &(0x7f000000dac0)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f000000db00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f000000db40)=0x14) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f000000db80)={@multicast1, @remote, 0x0}, &(0x7f000000dbc0)=0xc) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f000000e880)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f000000e840)={&(0x7f000000dc00)={0xc14, r3, 0x40c, 0x70bd28, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0x4}}, {{0x8, 0x1, r5}, {0xb8, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}]}}, {{0x8, 0x1, r8}, {0x44, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r9}}, {0x8}}}]}}, {{0x8, 0x1, r10}, {0xb4, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r12}}, {0x8}}}]}}, {{0x8, 0x1, r13}, {0x1e4, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xca0}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x228, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x7f, 0x27, 0x4, 0x10000}]}}}, {0xffffffffffffffed, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xeb}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r20}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x100}}, {0x8, 0x6, r21}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r22}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x14, 0x4, [{0x3, 0x1ff, 0x6, 0x9}, {0x1, 0x3, 0x7fffffff, 0x3}]}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r23}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r24}}}]}}, {{0x8, 0x1, r25}, {0x2a0, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x80000001}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r26}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r27}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x8, 0x5, 0x433, 0x2}, {0x3, 0x8, 0x5bbcf769, 0x3}, {0x0, 0x4, 0x1, 0x800}, {0x2, 0x4, 0x7, 0x3}, {0x800, 0x7fff, 0x6, 0x2}, {0x2, 0xb, 0x4, 0xe40}]}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x101}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfff}}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r30}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r31}}}, {0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x8a, 0x4, 0xfffffffffffffff8, 0x5}, {0x7, 0xfffffffffffffffe, 0x2}, {0x1, 0x800, 0x2, 0x3}, {0x7, 0x8, 0x0, 0x400}]}}}]}}, {{0x8, 0x1, r32}, {0x25c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x101}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xffff}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4ca}}, {0x8, 0x6, r33}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xb19d}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000001}}}]}}, {{0x8, 0x1, r34}, {0xfc, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}, {0x8, 0x6, r35}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r36}}, {0x8}}}]}}]}, 0xc14}, 0x1, 0x0, 0x0, 0x10}, 0xc090) r37 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r37}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r37, &(0x7f0000000180)=ANY=[@ANYBLOB="280000000300fbdd000000000000000001000000001300000700000000000000757365725f696400"], 0x28) read$FUSE(r37, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r37, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r37, &(0x7f0000001000), 0x1000) 14:02:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000007ce00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:54 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf0ffff) 14:02:54 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000074100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 516.965734] overlayfs: './file0' not a directory 14:02:55 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001a6) 14:02:55 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) setsockopt$sock_timeval(r0, 0x1, 0x0, &(0x7f0000000140)={0x77359400}, 0x10) 14:02:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000018700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:55 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x900) 14:02:55 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000000e) 14:02:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000006b600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 517.418088] overlayfs: './file0' not a directory [ 517.437863] overlayfs: './file0' not a directory 14:02:55 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000240)='./file1\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") readahead(r0, 0x81, 0x6) chdir(&(0x7f0000000300)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:55 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf5ffffff) 14:02:55 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) r2 = fcntl$dupfd(r0, 0x406, r0) ioctl$RNDZAPENTCNT(r2, 0x5204, 0xfffffffffffffffe) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:55 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) read(r0, &(0x7f00000003c0)=""/115, 0x73) r1 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f00000002c0)={{0x0, 0x1, 0x7, 0x3, 0xfffffffffffffff9}, 0x6, 0x4, 'id1\x00', 'timer1\x00', 0x0, 0x8, 0x0, 0x3ff, 0x2d}) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000221a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:55 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf000) [ 517.773255] overlayfs: './file0' not a directory [ 517.809777] overlayfs: './file0' not a directory 14:02:55 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000197) 14:02:55 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001b7800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:55 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x300) 14:02:55 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file2\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:55 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000074) 14:02:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000011a000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 518.296974] overlayfs: './file0' not a directory [ 518.309303] overlayfs: filesystem on './file0' not supported as upperdir 14:02:56 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) write$P9_RATTACH(r0, &(0x7f0000000140)={0x14, 0x69, 0x1, {0x2, 0x0, 0x2}}, 0x14) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'vcan0\x00', r2}) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:56 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xff0f000000000000) [ 518.504124] overlayfs: './file0' not a directory 14:02:56 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) connect$rds(r0, &(0x7f0000000100)={0x2, 0x4e23, @remote}, 0x10) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f0000001000), 0x1000) 14:02:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001dfc00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:56 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x7, 0x8, "3013924c0326081d595b34f0e3eb567b29bf8269b13fd6a7f0e976dfcf6e7940f49d1a22989eebffa6e6432289382088ad5e775cbdbf73c32f493c41fb5ed65f", "cf5608155141a90ca5fc20c33a7c56175e1bdd2b06153bec029f331b00604cb5", [0x3, 0x2]}) chdir(&(0x7f0000000140)='./file1/file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 518.527726] overlayfs: './file0' not a directory 14:02:56 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfe00) [ 518.681646] overlayfs: filesystem on './file0' not supported as upperdir [ 518.770426] overlayfs: './file0' not a directory 14:02:56 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="75707065726469723d2e2f088eb866696c65302c6c6f7765726469723d2e2f66696c65312c77cee66b6469723d2e2f6669140831"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:56 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000b200) 14:02:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001aa400637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:56 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x700) 14:02:56 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000031) 14:02:56 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001fc100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 519.197970] overlayfs: unrecognized mount option "wÎækdir=./fi1" or missing value [ 519.221750] overlayfs: unrecognized mount option "wÎækdir=./fi1" or missing value [ 519.232438] overlayfs: './file0' not a directory 14:02:57 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x8800000) 14:02:57 executing program 3: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000340)=0x0) ptrace$poke(0x5, r0, &(0x7f0000000380), 0xa7) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0xfffffffffffffffd) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") socketpair(0x8, 0x40000080807, 0x8d95d, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x42030, r2, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r3, &(0x7f0000000380)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x5, 0x0, "913fa7c292d3d3841feaa73b24735180b4fadafbd0ae8fdf06dc1c0fffaedf7b3cf0239733e29abbc5d501554cc12846eb3ebd34bab758954fc222777a53c4c0a8e473b6e9bb9bd5b5f2ee63c9774539"}, 0xd8) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x5, @loopback}, @in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e24, 0xfffffffffffffffe, @ipv4={[], [], @local}}], 0x48) dup(r3) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000007c0), 0xffffffffffffffba) ioctl$sock_SIOCSIFBR(0xffffffffffffffff, 0x8941, &(0x7f0000000180)=@generic) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240), 0x8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8937, &(0x7f0000000000)={'bridge_slave_1\x00', @random="01003a1e2410"}) write$binfmt_elf32(0xffffffffffffffff, &(0x7f00000008c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x6, 0x20, 0x327, 0x38, 0x30b, 0x9, 0x0, 0x20, 0x1, 0x7, 0x4, 0x299a}, [{0x5, 0x5, 0xffffffffffffffbc, 0x8a, 0x4, 0x1, 0x4, 0x865}], "ff511270300fb97d148022213b0a39b8206e6fb250bfe758cf6f9ad517864096bcb0dcb3cd0abd9cf03a1a146169b2b838707de519ea6a83a5c59d36d599779d08e1b3a573f8e17c6bf264acb73e9f4309b27ed1871318ff164c5f18b497e28888acddb9728ecd095e558c629f57fc9e5840487c47e1081337014e6e65dd118220c5b9cd761d9fa945354469e0eda31b715bebaf5c1ab155fe15a83ccd76b23a3781bdfa8476da0b08230a1c4f94bdd50b5ede0edcc52bf9482c967e1dc4a6644972de7cae84b500acb7207edbf85493d8267f4a6a775f4636b9a5429b4f6b99085b0b1f"}, 0x13c) getpeername(0xffffffffffffffff, &(0x7f00000004c0)=@hci, &(0x7f0000000580)=0x10d) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000340), 0xc, &(0x7f0000000600)={&(0x7f0000000580)=ANY=[]}}, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@local, @in=@broadcast}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8) 14:02:57 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000007b200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:57 executing program 5: rt_sigprocmask(0x2, &(0x7f0000000540)={0x1000000000}, &(0x7f0000000580), 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x5, 0x480) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000021}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x54, r2, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x401}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3ff}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x180}]}, 0x54}, 0x1, 0x0, 0x0, 0x24000050}, 0x4000000) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r4 = geteuid() mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000001c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id'}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x800}}, {@max_read={'max_read', 0x3d, 0x4}}, {@default_permissions='default_permissions'}]}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="28000000030000000000000000000000010000000000000005000000d899abe91f00000000757365"], 0x28) read$FUSE(r3, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r3, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r3, &(0x7f0000001000), 0x1000) [ 519.451127] overlayfs: './file0' not a directory [ 519.457057] overlayfs: filesystem on './file0' not supported as upperdir 14:02:57 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xe4ffffff00000000) 14:02:57 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x4) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:57 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000540)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r2 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x80000000, 0x10000) ioctl$KVM_GET_XCRS(r2, 0x8188aea6, &(0x7f0000000580)=ANY=[@ANYBLOB="050000000709000006000000000000000101000000000000060000000000000005000000000000000101000000000000060000000000000003000000000000003f0000000000000000100000000000000d000000000000005880ea9b2e7998edeae7ff3d1f5e782a43972e7af01c0d2db0a8067d6d26e10dad346f1c7c74077582e86403546959a858b5c5d14dbbb6338789de7153af27a44fc0b16f68d86accb89682ab6553578aac4002a335706f35f19679180fb5998bf5e2cb7290501c083a509fd5d56b9ee03891e143c9"]) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x127, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9bd5441fe9650019f40f000085d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515762e4fca12e020f30", 0x67, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) setsockopt$packet_buf(r2, 0x107, 0x1f, &(0x7f0000000480)="c7b00e70d7f5fa2d0f7b49415e44c7e06048f2b86ab4d31ecd3497539816ce243fffb149d2a6181e478fc69009b36fe4c21b5e8c58259a05c16390acb1acfcccc4034c754efe4f18", 0x48) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 519.658242] overlayfs: './file0' not a directory [ 519.677855] overlayfs: './file0' not a directory 14:02:57 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20001601) 14:02:57 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000016f400637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:57 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) sched_yield() r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\v']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:02:57 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) stat(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000340)='./file0/file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r1, r2) openat$md(0xffffffffffffff9c, &(0x7f0000000400)='/dev/md0\x00', 0x40002, 0x0) r3 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) fcntl$setflags(r3, 0x2, 0x1) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r4 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r4, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:57 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x20000000000000) 14:02:57 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000006f) 14:02:57 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f00000050c0), 0xffffffffffffff40) 14:02:57 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf0ffffff0f0000) [ 520.090807] overlayfs: filesystem on './file0' not supported as upperdir 14:02:57 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20005b00) 14:02:57 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000160500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:57 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000140)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file0/file0\x00', 0x60) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000140)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:58 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xe7fd000000000000) [ 520.320207] overlayfs: './file0' not a directory [ 520.403859] overlayfs: './file0' not a directory 14:02:58 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000137) 14:02:58 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000038) 14:02:58 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000014a100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:58 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0xc200, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f0000000100)={'icmp6\x00'}, &(0x7f0000000380)=0x1e) mount$overlay(0x400000, &(0x7f00000003c0)='./file1/file0\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="7570723dcd74bd35d4cf62686c6f7765726469723d2e4ddd65ed9634cb336f726b6469723d2e2f66696c6531"]) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vsock\x00', 0x20000, 0x0) ioctl$KVM_GET_NESTED_STATE(r3, 0xc080aebe, &(0x7f0000000b80)={0x0, 0x0, 0x2080}) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f00000002c0)=0x5, 0x4) r4 = creat(&(0x7f0000000880)='./file1/file0\x00', 0x4000000080) lsetxattr$security_selinux(&(0x7f0000000840)='./file1/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) unlinkat(r4, &(0x7f0000000240)='./file0\x00', 0x0) r5 = socket$inet6(0xa, 0x1000000000001, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000440)={0x0, @in={{0x2, 0x4e21, @multicast1}}, 0xaf4, 0x7ff, 0x1, 0x7ff, 0x100000000}, &(0x7f0000000500)=0x98) ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000540)={r6, @in={{0x2, 0x4e22, @multicast1}}, 0x3ff, 0x6e5, 0x3, 0xffff, 0x4}, &(0x7f0000000600)=0x98) mkdirat(r2, &(0x7f0000000640)='./file0/file1\x00', 0x8) ioctl(r5, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$sock_FIOGETOWN(r5, 0x8903, &(0x7f0000000680)=0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x4000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000006c0)={{{@in=@rand_addr, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f00000007c0)=0xe8) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000000800)={0x4, 0x859, r7, 0xffffffff, r8, 0x78785d69, 0x6, 0x48d}) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) setsockopt$inet_icmp_ICMP_FILTER(r3, 0x1, 0x1, &(0x7f0000000000)={0x8}, 0x4) 14:02:58 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x3000) [ 520.895522] __ntfs_error: 43 callbacks suppressed [ 520.895531] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 520.911526] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 520.948300] Unknown ioctl -1065308482 [ 520.968617] overlayfs: './file0' not a directory 14:02:58 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000012d) 14:02:58 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000015d700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:58 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffff8b) 14:02:58 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x401}}, 0x66) socketpair$inet(0x2, 0x4, 0x3, &(0x7f0000000100)) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="6cd363bf4ab3c886762f7573626d8ffbf0dc00281bc3aa396697a981aad35e8950fbdad001"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 521.048928] ntfs: (device loop3): parse_options(): Unrecognized mount option ./file0. [ 521.088137] Unknown ioctl -1065308482 14:02:58 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = accept$nfc_llcp(0xffffffffffffff9c, &(0x7f0000000300), &(0x7f0000000380)=0x60) pwrite64(r0, &(0x7f00000003c0)="bfadcfe093515e37368f39b6baad4c70e47383146fbd389c8be57d93d1dae682aaec832c28d04d6ce3fc2d5895d5793eaa928ac8c785222386eed80156b4274a02efb123ee6ef14721a9e168b29cbd2c3d9cad9e8337eb8cc0505a5d2c27f17e34564676f846ba8e8a9db3970367f9bc525e54adffed72e6ec50c75a8a66584c1d43b8f54fb6659e7f894574caac1517a8c10673b8", 0x95, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) fsetxattr$security_smack_entry(r1, &(0x7f0000000240)='security.SMACK64MMAP\x00', &(0x7f00000002c0)='vmnet0\\\'-!/}$\x00', 0xe, 0x3) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 521.148364] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:58 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000185c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 521.228692] ntfs: (device loop3): parse_options(): Unrecognized mount option security.SMACK64MMAP. 14:02:59 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x2000000) [ 521.290689] overlayfs: './file0' not a directory [ 521.472546] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 521.541708] overlayfs: './file0' not a directory 14:02:59 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20006d00) 14:02:59 executing program 3: mkdir(&(0x7f0000000240)='./file0\x00', 0x0) symlink(&(0x7f0000000140)='./file1\x00', &(0x7f0000000180)='./file0/file0\x00') syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0xb9, 0x2) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001f3000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:02:59 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf00) 14:02:59 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000013d) [ 521.768283] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 521.790477] ntfs: (device loop3): parse_options(): Unrecognized mount option ./file0. 14:02:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000b3500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 521.834547] overlayfs: './file0' not a directory 14:02:59 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x2614) [ 521.905702] IPVS: ftp: loaded support on port[0] = 21 [ 521.920111] ntfs: (device loop3): parse_options(): Unrecognized mount option ./file0. [ 521.944101] overlayfs: filesystem on './file0' not supported as upperdir 14:02:59 executing program 3: mkdir(&(0x7f0000000140)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:02:59 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="0100"]) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000900)='/dev/vga_arbiter\x00', 0x0, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)={0x8}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sysfs$3(0x3) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) socket$packet(0x11, 0x3, 0x300) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 521.994014] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:02:59 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000002f100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 522.097525] device bridge_slave_1 left promiscuous mode [ 522.102099] overlayfs: failed to resolve './file1': -2 [ 522.103031] bridge0: port 2(bridge_slave_1) entered disabled state [ 522.136072] device bridge_slave_0 left promiscuous mode [ 522.150474] bridge0: port 1(bridge_slave_0) entered disabled state [ 522.229598] team0 (unregistering): Port device team_slave_1 removed [ 522.250820] team0 (unregistering): Port device team_slave_0 removed [ 522.261545] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 522.272957] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 522.316346] bond0 (unregistering): Released all slaves 14:03:00 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x80000000000000) [ 522.347941] overlayfs: './file0' not a directory 14:03:00 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001b9f00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:00 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20006201) 14:03:00 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x2000) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000240)={0xa, 0x2, 0x9}) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/attr/current\x00', 0x2, 0x0) 14:03:00 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x3000000000000000) 14:03:00 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000223900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 522.909228] overlayfs: './file0' not a directory [ 523.399204] bridge0: port 1(bridge_slave_0) entered blocking state [ 523.405596] bridge0: port 1(bridge_slave_0) entered disabled state [ 523.412893] device bridge_slave_0 entered promiscuous mode [ 523.437122] bridge0: port 2(bridge_slave_1) entered blocking state [ 523.443497] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.450615] device bridge_slave_1 entered promiscuous mode [ 523.475422] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 523.499570] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 523.569246] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 523.597067] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 523.622250] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 523.629340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 523.654063] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 523.661039] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 523.743809] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 523.753047] team0: Port device team_slave_0 added [ 523.777859] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 523.784933] team0: Port device team_slave_1 added [ 523.807586] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 523.832315] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 523.857019] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 523.864080] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 523.876103] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 523.892372] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 523.899447] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 523.907334] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 524.105435] bridge0: port 2(bridge_slave_1) entered blocking state [ 524.111815] bridge0: port 2(bridge_slave_1) entered forwarding state [ 524.118453] bridge0: port 1(bridge_slave_0) entered blocking state [ 524.124811] bridge0: port 1(bridge_slave_0) entered forwarding state [ 524.132452] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 524.656771] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 524.842119] 8021q: adding VLAN 0 to HW filter on device bond0 [ 524.916546] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 524.989433] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 524.995564] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 525.003083] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 525.074314] 8021q: adding VLAN 0 to HW filter on device team0 14:03:04 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000bf) 14:03:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001a4200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:04 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xa000000) 14:03:04 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@mcast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, &(0x7f0000000700)=0xe8) syz_mount_image$btrfs(&(0x7f0000000100)='btrfs\x00', &(0x7f00000001c0)='./file0\x00', 0x20, 0x4, &(0x7f0000000580)=[{&(0x7f0000000200)="5cd1c5660391b18a7e634ee71e08e284298ddaf80c9efb75b7e7d47f358f8140374fb8343e09bcd1905cd87ad1ab3f312d0d0c818bd22de9499bf5ce2954b67a2e194c9c427872e2f98db11a31d3b026178e6646c5741786c87fdfb590c1875e5849486215e5", 0x66, 0xfff}, {&(0x7f0000000480)="19070a126b402b875b30f335b2e3d04159a073d826abefacfac06e2203c2ff0a1038dfd0ab218fefa53c671a73f30b0db0c7c83a99ef93046abe921c25bb7373fce5729e5f6f6ec11377", 0x4a, 0x7}, {&(0x7f00000003c0)="9b25e1399b7be941a2ecc1cbc62ee476de780da198d80069abf7426ff51f55210f1bcab0280d84765ed34731ac5acd475259", 0x32, 0x8000}, {&(0x7f0000000500)="9bf57abd7b9fd912e469f3b94f9fdd1cbc302d6a6a8c3dde729a73ae2dff86d9d0cf820b36ee823633aed17049306e1a5c081301d5ef5ff307f4ef7924a9fb2991115457a5858597b9c28d756259b9d1e664a36dc530c7a5417e0deb03", 0x5d, 0x2}], 0x100840, &(0x7f0000000800)={[{@nospace_cache='nospace_cache'}, {@compress_algo={'compress', 0x3d, 'lzo'}}, {@treelog='treelog'}, {@discard='discard'}, {@flushoncommit='flushoncommit'}, {@fragment_all='fragment=all'}], [{@pcr={'pcr', 0x3d, 0x2d}}, {@fowner_lt={'fowner<', r2}}, {@smackfsdef={'smackfsdef', 0x3d, '/dev/fuse\x00'}}, {@smackfshat={'smackfshat', 0x3d, '/dev/fuse\x00'}}]}) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@random={'security.', '\x00'}, &(0x7f0000000340)='group_id', 0x8, 0x4) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:03:04 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f626070004000000000") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:04 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000e6) [ 526.324070] __ntfs_error: 7 callbacks suppressed [ 526.324079] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 526.342055] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 526.384199] overlayfs: './file0' not a directory [ 526.405576] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:03:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000034500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:04 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000140)={0x9, [0x7f, 0x4, 0x4, 0x1, 0x401, 0x7f, 0x1, 0x2e, 0x8]}, &(0x7f0000000240)=0x16) 14:03:04 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x30000000) 14:03:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000202500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 526.549138] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 526.552915] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 526.613910] overlayfs: './file0' not a directory 14:03:04 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x3f00000000000000) 14:03:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000132900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 526.640227] ntfs: (device loop3): parse_options(): Unrecognized mount option . [ 526.747603] overlayfs: failed to resolve './file1': -2 [ 526.772211] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 526.838841] overlayfs: failed to resolve './file1': -2 [ 526.847164] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. 14:03:04 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000ec00) 14:03:04 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000009c100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:04 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x8bffffff00000000) 14:03:04 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65312c776f726b6469723d2e2f66696c6531be8181ea08"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:04 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000ac01) 14:03:04 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x1, 0x10400) ioctl$BLKROGET(r2, 0x125e, &(0x7f00000001c0)) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303034303030312c757365725f69643d450a30183b9650da96470b558555ed981b7b1ee24e75658f788f72a1cd5bf71ab3f655200449f512f246047b6ff028846ea17bd58cc8d7cce37a530124e75478250262800e3a7d82211ca1b66a244d736cc3129fd8fc24e0671b7707204c57c07192af0a897e", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0x8, 0xfffffffffffffffd) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 527.211325] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 527.224779] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 527.243532] overlayfs: failed to resolve './file1¾ê': -2 14:03:05 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=@random={'user.', 'X\'nodevkeyringlo\x00'}, &(0x7f0000000340)='group_id', 0x1, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:03:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000c0c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 527.275086] overlayfs: failed to resolve './file1¾ê': -2 [ 527.293070] overlayfs: './file0' not a directory 14:03:05 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65312c776f726b457d963986cc5d846c6531dfabf4a569ce41eceda500807d2ccf9533bcff13968aa3"]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f00000002c0)=0xc) fcntl$setown(r1, 0x8, r2) chdir(&(0x7f0000000280)='./file0\x00') fanotify_mark(r0, 0x2, 0x40020000, r0, &(0x7f0000000140)='./file1/file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:05 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x20000000) 14:03:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001e8000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:05 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xff01) [ 527.460355] overlayfs: unrecognized mount option "workE}–9†Ì]„le1ß«ô¥iÎAìí¥" or missing value [ 527.491029] overlayfs: unrecognized mount option "workE}–9†Ì]„le1ß«ô¥iÎAìí¥" or missing value [ 527.653765] overlayfs: './file0' not a directory 14:03:05 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002900) 14:03:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000004e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:05 executing program 3: prctl$getreaper(0x3d, &(0x7f0000000240)) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='uperdir=./file0,lmwerdir=./file1,workd[r=./f-l%1\x00']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = getuid() fstat(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f00000002c0)='./file1\x00', r1, r2) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r3 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r3, 0x0, &(0x7f0000000140)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:05 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x5) 14:03:05 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000e700) [ 528.108173] overlayfs: unrecognized mount option "uperdir=./file0" or missing value [ 528.139019] overlayfs: './file0' not a directory 14:03:05 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000ed500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 528.166004] overlayfs: unrecognized mount option "uperdir=./file0" or missing value 14:03:08 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = syz_open_dev$dri(&(0x7f0000000140)='/dev/dri/card#\x00', 0x9, 0x8000) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000240)={0x0, 0x80000}) ioctl$DRM_IOCTL_GEM_CLOSE(r0, 0x40086409, &(0x7f00000002c0)={r1}) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="d5b5f4199af302f9766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:08 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000c701) 14:03:08 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffffff000) 14:03:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001e2800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:08 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="2800000003000000000000000000000001000000000000000700000500000000757365725f696400"], 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000080)={0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) open_by_handle_at(r0, &(0x7f0000000200)={0xa, 0x0, '90'}, 0x0) r2 = socket(0xa, 0x3, 0x8) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={"6272696467653000000100"}) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000040)=@assoc_value, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f00000003c0)={0x0, 0x0, 0x22, 0x6, 0x11100000000000, 0xffffefffffffffff}, 0xe) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000001c0)) ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f0000000240)={0x101, 0x0, 0x7fff, 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000100)={'bridge0\x00', 0xfffffffffffffffd}) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@local, @in6=@mcast1, 0x0, 0x7, 0x4e21, 0xfffffffffffffffd}, {0x0, 0x0, 0x0, 0x31, 0x0, 0xfffffffffffffffd, 0x100, 0x200000000000007}}, {{@in6=@mcast2, 0x4d6}, 0x0, @in6=@remote, 0x3500, 0x3, 0x3, 0x0, 0xc723}}, 0xe8) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8932, &(0x7f0000000000)={"626f6e64300000000400", 0x40800000002ffd}) ioctl$PPPOEIOCSFWD(r2, 0x4008b100, &(0x7f0000000140)={0x18, 0x0, {0x3, @dev={[], 0x1f}, 'syzkaller1\x00'}}) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:03:08 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000001c) 14:03:08 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20004b00) 14:03:08 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x200000000000000) [ 530.609906] overlayfs: './file0' not a directory 14:03:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000bf100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:08 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000340)='security.selinux\x00', &(0x7f0000000380)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000400)={{{@in=@rand_addr, @in6=@dev}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000240)=0xe8) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000140)={0x1, 0x200, 0x5, 0x5}) [ 530.637823] bridge0: port 2(bridge_slave_1) entered disabled state [ 530.645714] bridge0: port 1(bridge_slave_0) entered disabled state 14:03:08 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000dc01) [ 530.759875] device bridge0 left promiscuous mode [ 530.786487] bridge0: port 2(bridge_slave_1) entered blocking state [ 530.792984] bridge0: port 2(bridge_slave_1) entered forwarding state [ 530.799673] bridge0: port 1(bridge_slave_0) entered blocking state [ 530.806067] bridge0: port 1(bridge_slave_0) entered forwarding state [ 530.814012] device bridge0 entered promiscuous mode [ 530.824973] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 14:03:08 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x3000000) 14:03:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000008fb00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 530.843956] overlayfs: './file0' not a directory 14:03:08 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) prctl$getreaper(0x28, &(0x7f0000000140)) socket$inet6(0xa, 0xa, 0x401) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765e76469723d2e2f66696c65312c776f726b6469723d2e2f66696c6531"]) r0 = dup(0xffffffffffffff9c) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) utimensat(r0, &(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000340)={{r1, r2/1000+10000}, {0x77359400}}, 0x0) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r3 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r3, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) mknod(&(0x7f0000000240)='./file1/file0\x00', 0x8001, 0x7) 14:03:08 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000002ee00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 530.969628] overlayfs: './file0' not a directory 14:03:08 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x40000000) [ 531.021997] overlayfs: unrecognized mount option "loweçdir=./file1" or missing value [ 531.071024] overlayfs: unrecognized mount option "loweçdir=./file1" or missing value [ 531.336937] bridge0: port 2(bridge_slave_1) entered disabled state [ 531.343782] bridge0: port 1(bridge_slave_0) entered disabled state [ 531.350921] device bridge0 left promiscuous mode [ 531.360778] bridge0: port 2(bridge_slave_1) entered blocking state [ 531.367443] bridge0: port 2(bridge_slave_1) entered forwarding state [ 531.374144] bridge0: port 1(bridge_slave_0) entered blocking state [ 531.380533] bridge0: port 1(bridge_slave_0) entered forwarding state 14:03:09 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="d71010d9430e642a35bcc215202035e87ca239d75d5c27e4124f21c8a7ea3e4b62ac7e0aa22b9de610631d32aa519afe2ea4a077e840895f300afd8791f11fcdda27370495d8fb4af95af71cad2de993b4fdc89cad0800000008e1cd21dc3ae25436f72c78719d696230"]) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x4f0100, 0x0) write$sndseq(r2, &(0x7f0000000480)=[{0x5, 0x400, 0x4, 0x0, @tick=0x6, {0x100000000, 0x8}, {0x6, 0x1}, @raw32={[0x8, 0x4]}}, {0xfff, 0xffffffff, 0x6, 0x8, @tick=0x4, {0x63edfd75, 0x3}, {0x8, 0x4}, @queue={0xfff, {0x6, 0x7f000}}}, {0x8001, 0x80000001, 0xfc, 0x2, @time={0x77359400}, {0x1, 0x4}, {0x3, 0x4}, @quote={{0x6, 0x4}, 0x54e}}, {0x7f, 0x8e2, 0x2, 0xf2, @time={0x0, 0x1c9c380}, {0x7, 0x8}, {0x0, 0x81}, @queue={0x8, {0x4, 0x2e8a}}}, {0x1, 0x4, 0x0, 0x5, @tick=0x10000, {0x7, 0x101}, {0x3, 0x8}, @result={0x24ff, 0x897}}], 0xf0) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:03:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000088500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:09 executing program 3: pivot_root(&(0x7f0000000380)='./file1/file0\x00', &(0x7f0000000340)='./file1/file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) mknod(&(0x7f00000002c0)='./file1/file0\x00', 0x140, 0x5) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000300)='./file1/file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:09 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x1426) 14:03:09 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000f9) [ 531.387509] device bridge0 entered promiscuous mode [ 531.392861] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 531.440096] __ntfs_error: 21 callbacks suppressed [ 531.440105] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 531.454526] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:03:09 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x10000, 0x0) syz_extract_tcp_res$synack(&(0x7f00000001c0), 0x1, 0x0) ioctl$UI_SET_SWBIT(r2, 0x4004556d, 0xf) [ 531.513926] overlayfs: './file0' not a directory [ 531.522968] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. [ 531.543706] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:03:09 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000013a) 14:03:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001b1600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 531.584353] overlayfs: filesystem on './file0' not supported as upperdir 14:03:09 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x1400) 14:03:09 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000140)='./file0/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000024600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:09 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000017b) [ 531.748633] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 531.772463] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 531.796449] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 14:03:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000111e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 531.833999] overlayfs: './file0' not a directory [ 531.848643] overlayfs: './file0' not a directory [ 531.863334] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 531.867269] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. 14:03:09 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf0ff) 14:03:09 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000b0300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:09 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x100, 0x2002) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000002c0)=0xc) fstat(r0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ATTR(r0, &(0x7f0000000380)={0x78, 0x0, 0x8, {0x8001, 0x6, 0x0, {0x0, 0x3ff, 0x0, 0x100000000, 0x87, 0xffffffffffffff09, 0x7f, 0x4, 0x2, 0x200, 0x812d, r1, r2, 0x80, 0x459f8967}}}, 0x78) r3 = socket$inet6(0xa, 0x1000000000001, 0x0) truncate(&(0x7f0000000240)='./file1/file0\x00', 0x2) ioctl(r3, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 532.147695] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 532.158179] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:03:09 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000181) [ 532.202406] overlayfs: './file0' not a directory [ 532.219821] overlayfs: filesystem on './file0' not supported as upperdir 14:03:10 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) r2 = dup2(r0, r1) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x7ff, 0x30}, &(0x7f00000001c0)=0xc) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000200)=@assoc_value={r3, 0x6}, &(0x7f0000000240)=0x8) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f00000050c0), 0x13ac) 14:03:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000186d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:10 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x2) 14:03:10 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000440)='overlay\x00', 0x800000001, &(0x7f0000000100)=ANY=[@ANYRES16=0x0]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) lsetxattr$trusted_overlay_redirect(&(0x7f0000000140)='./file1/file0\x00', &(0x7f0000000240)='trusted.overlay.redirect\x00', &(0x7f00000003c0)='./file0/file0\x00', 0xe, 0x3) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) accept(r0, &(0x7f00000002c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000340)=0x80) bind$packet(r0, &(0x7f0000000380)={0x11, 0x0, r2, 0x1, 0xb8, 0x6, @dev={[], 0x12}}, 0x14) 14:03:10 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f0000000240)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYRES32=0x0]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000140)) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:ssh_exec_t:s0\x00', 0x20, 0x2) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f00000002c0)={0x5, 0x5, [{0x0, 0x0, 0x9}, {0x401, 0x0, 0x46e}, {0x1bfe, 0x0, 0x80000000}, {0x3, 0x0, 0x1}, {0xffffffffffffffe1, 0x0, 0x100000001}]}) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000400)={&(0x7f00000003c0)=[0xfc6], 0x1, 0x8001, 0x3, 0x5, 0xffffffff, 0x7f, {0x9, 0x9, 0x38ee, 0x3, 0x48, 0x8, 0xd19, 0x80000001, 0x5, 0x0, 0x1ff, 0x7ff, 0x80000000, 0x7725, "08ff9b319af4c1623ddbd2ce9aa01feeff6bcedf9d1a7779eaa970c6743ad0e3"}}) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) symlinkat(&(0x7f0000000340)='./file0\x00', r0, &(0x7f0000000380)='./file1\x00') [ 532.542600] overlayfs: './file0' not a directory 14:03:10 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000010b) 14:03:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000e3c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:10 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfffffffffffffff0) [ 532.688452] overlayfs: missing 'lowerdir' [ 532.721345] overlayfs: missing 'lowerdir' 14:03:10 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001a9600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 532.761509] overlayfs: './file0' not a directory 14:03:10 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x440400, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000240)) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f00000002c0)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:10 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x7000000) [ 532.794752] IPVS: ftp: loaded support on port[0] = 21 [ 532.807156] device bridge_slave_1 left promiscuous mode [ 532.829092] bridge0: port 2(bridge_slave_1) entered disabled state [ 532.842727] device bridge_slave_0 left promiscuous mode [ 532.865939] bridge0: port 1(bridge_slave_0) entered disabled state [ 532.927367] team0 (unregistering): Port device team_slave_1 removed [ 532.939143] team0 (unregistering): Port device team_slave_0 removed [ 532.951521] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 532.965503] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 533.003644] bond0 (unregistering): Released all slaves [ 533.032018] overlayfs: './file0' not a directory [ 533.039220] overlayfs: './file0' not a directory 14:03:10 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000d201) 14:03:11 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="28000000030000000000000000000000050000000000000007000000640000000000000000000000"], 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) 14:03:11 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000090c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:11 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdiowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x6d1fdd3e, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:11 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x8040000) [ 533.437929] overlayfs: unrecognized mount option "upperdiowerdir=./file1" or missing value [ 533.460455] overlayfs: './file0' not a directory [ 533.475683] overlayfs: unrecognized mount option "upperdiowerdir=./file1" or missing value 14:03:11 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x1000000) [ 533.684931] overlayfs: './file0' not a directory [ 534.036932] bridge0: port 1(bridge_slave_0) entered blocking state [ 534.043311] bridge0: port 1(bridge_slave_0) entered disabled state [ 534.050463] device bridge_slave_0 entered promiscuous mode [ 534.073998] bridge0: port 2(bridge_slave_1) entered blocking state [ 534.080447] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.087559] device bridge_slave_1 entered promiscuous mode [ 534.111414] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 534.135657] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 534.200459] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 534.226113] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 534.347152] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 534.354202] team0: Port device team_slave_0 added [ 534.375550] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 534.382658] team0: Port device team_slave_1 added [ 534.404343] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 534.428018] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 534.453314] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 534.476861] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 534.676035] bridge0: port 2(bridge_slave_1) entered blocking state [ 534.682431] bridge0: port 2(bridge_slave_1) entered forwarding state [ 534.689079] bridge0: port 1(bridge_slave_0) entered blocking state [ 534.695424] bridge0: port 1(bridge_slave_0) entered forwarding state [ 535.423553] 8021q: adding VLAN 0 to HW filter on device bond0 [ 535.493314] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 535.564585] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 535.570751] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 535.578753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 535.650109] 8021q: adding VLAN 0 to HW filter on device team0 14:03:14 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001a1) 14:03:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000104100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:14 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75707065723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65312c776f726b64697202002f66696c6531"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x3) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:14 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x9) 14:03:14 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20003f01) 14:03:14 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0x80, 0x0) stat(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='9p\x00', 0x8400, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@access_any='access=any'}, {@cache_fscache='cache=fscache'}, {@mmap='mmap'}, {@msize={'msize'}}, {@access_uid={'access', 0x3d, r4}}, {@posixacl='posixacl'}, {@cache_fscache='cache=fscache'}], [{@dont_hash='dont_hash'}, {@measure='measure'}, {@audit='audit'}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x77, 0x37, 0x32, 0x75, 0x0, 0x37, 0x61], 0x2d, [0x77, 0x77, 0x32, 0x39], 0x2d, [0x34, 0x36, 0x65, 0x63], 0x2d, [0x7c, 0x38, 0x76], 0x2d, [0x62, 0x7f, 0x77, 0x33, 0x33, 0x39, 0x65, 0x77]}}}, {@smackfshat={'smackfshat', 0x3d, 'user_id'}}]}}) setxattr(&(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000100)='group_id', 0xfffffe90, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r2, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r2, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=ANY=[@ANYBLOB="757365722e006465762f757372819ccb43e2"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r2, &(0x7f0000001000), 0x1000) [ 536.931421] __ntfs_error: 18 callbacks suppressed [ 536.931430] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 536.946738] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 536.969494] overlayfs: unrecognized mount option "upper=./file0" or missing value 14:03:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000180200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 536.990658] overlayfs: unrecognized mount option "upper=./file0" or missing value 14:03:14 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="75707065526469723d2e2f66696c65302c6c6f7765726469723da3ea7b773f2e2f2371b0fc077566696c65312c776f726b6469723d2e2f66696c55f46f4968d209d0003b6015aa2ac117d74d0f7fad09d73fc39298a57ff443f73b5881da94a025e42f530ae09b379f740d3ea29c1f596aacf98d24d5fec908c0fb03e9a6401344f5b9980e9469a13ed526c1963704f24d213aceeef4126c657c5817a6554f1b3d3c7473cbb675db38250af0df7b38b18a92481919c880a4de32643b5a98fb03d284f8d03b13fb30e4ae8647d9939abda39a09878788f8e8d2147c2b0885b3d64889d419b0513f5316c7d69fc3b36fca5f6843fcbfac7ec938437fed0f04e002918a1b3d6c0000000000000000000000"]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505331, &(0x7f0000000100)={{0xbb16, 0x7}, {0x8, 0xe4dd}, 0x5, 0x2, 0x4}) [ 537.031864] overlayfs: './file0' not a directory 14:03:14 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x900000000000000) 14:03:14 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000019700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 537.125905] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 537.158184] overlayfs: unrecognized mount option "uppeRdir=./file0" or missing value [ 537.173969] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 537.190440] overlayfs: unrecognized mount option "uppeRdir=./file0" or missing value [ 537.201548] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:03:15 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(0xffffffffffffff9c, 0xc02c5341, &(0x7f0000000440)={0x0, 0x0, 0x0, {0x0, 0x0}}) syz_mount_image$ntfs(&(0x7f00000003c0)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x6, &(0x7f0000001100)=[{&(0x7f0000000a80)="3241e135bb87336cce8837a91ee6e23d0a9fdfbc97de13c487777d97765152a0dcd33cfe71ea32e1d33c6d659d7ed436f40e4e", 0xfffffe1c}, {&(0x7f0000000e00)="78e2a64f29fa0b806ea31b455f4ef67c86a0b12fbf317a66b34eba8d4bab5e3c4d4849612af9362b04d06b259722cc941b0b20448937de4f0d7f4324ec148334eb06aa4761a8e6a49f7b04431bd3fcadf66ada3633b7b5d1d0bfc8550d60021b2178b5672904eafcd2b562af9fde0cc9220c69a69e5010f13c7d895ec16ef1394598d6146a71a9ff6ca2008b702261d36b640ccc9fcb2c88b6077a", 0x9b, 0x248}, {&(0x7f0000000ec0)="e66b4f953969fb1c3904edcdd75d40a93d9fe87ff54d95ca1d31abb7159edc38b4dbd184532a1b74f178caec1c0376e383f81bfe6022a06721c80bc8bab2dca6ca6c0d764855b7083f18254067edef824f16bb6bba21cb7338acd46c2e1e3e4cfbb38d2d4f00a5b9a7faf772a6e6035b7634baddab55cfe65af3f0ce66ca03e835300ca903b68f21f218ba6ba2682fded02f751834cc0932bfad438cb239446da3", 0xa1, 0x5}, {&(0x7f0000000f80)="9596033e628e", 0x6, 0x4}, {&(0x7f0000000fc0)="4753e9ab4424507d6fa6451e0507af116efaa5a5ef65deaaec7cd04be1ed0678a0b0f5a6ef1dfe8b8b2685938ef4eac64c503bd48ad3f4ebdea863942491363a780a", 0x42, 0x20}, {&(0x7f0000001040)="3893883a71839c56de18dd69f95e79af277b581087a287ac4518a00dabc0310f91f0fffb85794a554d0e27bc7c7dc9e4055bdb158377f219c04fb36a67dbe5d40f2923b658b8d432e1db55351238240da2f720754ebfbd9b5f3bd2d7d12b62387b82dce48c75dd6ab7c67424aae7f1f5a5578397da1ef8d5b54f7c1f86bbc3368eb816", 0x83, 0x7f}], 0x0, &(0x7f00000011c0)=ANY=[@ANYRESHEX, @ANYRES16, @ANYRESOCT=r1, @ANYRESDEC, @ANYPTR=&(0x7f0000000740)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYPTR=&(0x7f00000004c0)=ANY=[@ANYBLOB="c9c08d62f24a41000e1d096d5b271dfc", @ANYRESOCT, @ANYRES64, @ANYRESOCT, @ANYPTR, @ANYRESHEX=r0], @ANYPTR64=&(0x7f0000000540)=ANY=[@ANYPTR64], @ANYPTR64=&(0x7f0000000580)=ANY=[@ANYBLOB="3af74080faa276ff5d9fc715fefac9dbd9c5fdcddee16ff5adce2227fe9df509d7763376eed6005d2402608edf560b1183811442b2548661f6904f0269d1fe039c926a95ca1dc43670ecb77415f1194c1aa3b3e7a0625d29859134d86759af3a16f24a42b65d2130ea2e25ed07683b05a7406c46028ea43ef6aac71bedbc64f75cb93f014d9fb0070737972afc395a74d97de4", @ANYBLOB="4a0b6f8666c18bb4313f9e525590b32cea5b7f21a16ee0010caaed203b18a83512535e589e6e56fd1b94b1ab8c32b9ce158827febab94757b7fd06ea1d0dfa58986cfc214d2674eb4f79c99851804ccb6d117cb3cb3be3546248b4987f2bd7c0eff2fc75f9855057476c0158131d14333351a2ce1d36f7c0bdea5221059e14539ee898e743c4401ab4e76b37e6ffc5f1b6acb3d4e0a9369a18bae4d3fd11772f2fcc4c78e7531a455e270bc61724ff9d2196015e6900b696e50ba9872817ded9edd3c74daba151ff9087c80eedf431b1e1d841cbd49a2ffc24e7cbefc2c7d76687966ca30e", @ANYRESDEC, @ANYRES64=0x0], @ANYRESHEX, @ANYRES16, @ANYRESOCT], @ANYRESHEX=r0, @ANYPTR64=&(0x7f0000000b80)=ANY=[@ANYRESOCT=r1, @ANYPTR=&(0x7f00000007c0)=ANY=[@ANYBLOB="6bce2b6f8ef668749278e4379fc033aa65d0002851cdff67a4a865cab24311bc9a27c6e96cf94809f44d8a973a5ea4ee0472e4092e3b8e7cb7f16c8c32384d0f410fd74e8015488b35d8e7a762368b0783acbab738802f4aa7970d9b0f784a414d53a5394a1bb606508e8abd2280217df414926923ac87d151b493230c74153e", @ANYBLOB="01b15085d4a9b00451a20cfe286c460308334ddecaaf11ff62604b66b9dd8c56aa9f415f3f4601ee0038e794621fb36d89e41d8d830d79890bcb292003ea0822b955d94a728f62aa9b1adb694dc5dccbd6a0a68ea664f3d2382405fb5eff65b19ed7c4ac98cc31ed09fb69733b448564010ecfc22cd06614c8d91ecfc735504a883c9945bb87fc4f0ef818168b34526f8dccb77cfaa86be03ee6dad626f4a7865d4a81b82d8d92b0cd06b8eb5129e02a548dabeff3d00f3b47fb32bb5e2d05bf84ba3543c613e2eda5e7a612caf391b1bd998b84cef2f6639cd8a2d4de5c145fe6a1930051ec15770ea7b9656a7c66fb", @ANYRES64=r1, @ANYBLOB="e587d8b632cd0926ce617eacd4868c0afbebdb0a7aff5bcf9c49991d4da622cf24efa11cd69779ec93ce7545c99196ebf554c5a9fffe3808641699913ed438cb514647a4e9ed763dc7a1bd35bf5ca0447149c9b67c4108891d76583d7131b654a2c44f0146a133c5a2bc8c4c5a63870d296c50dfeace5b11dce0cea41025801f4c336823743a5368840123a5d02196d11daaaee5c856ef4c2f23750f619267294d4f9e7fe124782883216ea5f948ce439adc62cea5c5e8bc7fede5e0ee5b", @ANYRES16=r0], @ANYBLOB="2e03d66898202a2b539dc8ea567931fd75de987d22598806cb0030c0b9a0ce277d991e013fb401ff1647d62e035c0c4c3aae5d3cb1b4a1fba4f951df2a52b876ff92425068d594a76d5c2f551fe57da5363fed30fc9d0d288b77f8962d24291abc0f331e1c5ee1a9827f0a7787252c235a4434a3cb4ea5907128a38705cc0fea4d52de41ae3150978e63c28874c66921dd0209a6eb4e4507111034687ebddef43ee3f98acec6dd121be2bba545d14e2ab3e836cdd5096a170a7586708ab8b698c75bb2bb7b222de356266f1f841bfd8694edc1f2691eb028de9b1fdde8d4cfe8b25f120684fcbf82", @ANYPTR64, @ANYRES64=r0], @ANYPTR64=&(0x7f0000000a00)=ANY=[@ANYRESOCT=0x0, @ANYRES32=r0, @ANYRESDEC=r1, @ANYBLOB="a52a9a5a57b19179ba8d2a497e7131fc2cb467d87768e357fcbab291c37548f832c62920babc9f448ec74f3e", @ANYRESOCT=r1], @ANYRESDEC=0x0]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB="75707065726469723d2e2f661aa88e300e7a696c652e2f80696c2ea666696c6531a2df28cbc402ad2ed7bf85b8556a9eb9a503e23cae280b17750776e6bd729d37d3c13a0b281fcf145e63e39c742deb3864bf08"]) r2 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r3 = accept$inet6(r2, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000240)=0x1c) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x3f, 0x7}, &(0x7f0000000300)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000340)=@assoc_value={r4, 0x1000}, 0x8) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r5 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000380)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:15 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x10000000000000) [ 537.321259] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 537.341199] overlayfs: missing 'lowerdir' [ 537.432253] ntfs: (device loop3): parse_options(): Unrecognized mount option 0xffffffffffffffffÿÿ0177777777777777777777718446744073709551615@. [ 537.557436] overlayfs: missing 'lowerdir' [ 537.562091] ntfs: (device loop3): parse_options(): Unrecognized mount option 0xffffffffffffffffÿÿ0177777777777777777777718446744073709551615@. 14:03:15 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20005500) 14:03:15 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xa00) 14:03:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000008cc00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:15 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperd8\tcir=./file0,lowerdir=./file1,workdir=./fi']) mkdir(&(0x7f0000000080)='./file0/file0\x00', 0x2) r0 = creat(&(0x7f0000000e40)='./file1/file0\x00', 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000340)=@mangle={'mangle\x00', 0x1f, 0x6, 0x5b0, 0x0, 0x3e0, 0x3e0, 0xd8, 0x210, 0x518, 0x518, 0x518, 0x518, 0x518, 0x6, &(0x7f00000002c0), {[{{@uncond, 0x0, 0x98, 0xd8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x80000000, 0x8, @ipv4=@multicast1, 0x8}}}, {{@uncond, 0x0, 0xd8, 0x138, 0x0, {}, [@common=@set={0x40, 'set\x00', 0x0, {{0x9, [0x7fc, 0x4, 0x8, 0xfff, 0x3, 0x200], 0x9, 0x7ff, 0x7fff}}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x6, [0x8a9, 0x78, 0x236b8a7b, 0x3c, 0x8, 0x7ff], 0xfffffffffffffa18, 0xa7, 0x5}, {0x8, [0x3ff, 0x1374, 0x7, 0x2, 0x7, 0x9], 0x3, 0xeb8e, 0x9}}}}, {{@uncond, 0x0, 0xe8, 0x110, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x5}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x401, 0x3}}}, {{@ip={@local, @multicast2, 0x0, 0xffffff00, 'veth0_to_bridge\x00', 'veth0\x00', {}, {}, 0x3e, 0x2, 0x8}, 0x0, 0x98, 0xc0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ip={@dev={0xac, 0x14, 0x14, 0xd}, @dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0xffffff00, 'ifb0\x00', 'tunl0\x00', {}, {0xff}, 0x1, 0x1, 0x1}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@osf={0x50, 'osf\x00', 0x0, {'syz1\x00', 0x7f, 0x0, 0x0, 0x2}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x8}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x4}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x610) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={r0, 0x28, &(0x7f0000000140)}, 0x10) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000980)={{0x0, 0x7ff}, 'port0\x00', 0x4, 0x801, 0x1, 0x9, 0x100000000, 0x7, 0x7, 0x0, 0x1, 0x5}) lsetxattr(&(0x7f0000000a40)='./file1\x00', &(0x7f0000000a80)=@random={'trusted.', '.\'\x00'}, &(0x7f0000000b80)=':{]\x00', 0x4, 0x1) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000bc0), &(0x7f0000000c00)=0x4) ioctl(r1, 0x8912, &(0x7f0000000c80)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') write$RDMA_USER_CM_CMD_GET_EVENT(r0, &(0x7f0000000e80)={0xc, 0x8, 0xfa00, {&(0x7f0000000cc0)}}, 0x10) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:15 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000b901) 14:03:15 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = fcntl$getown(r0, 0x9) getpriority(0x1, r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="66643dd4b0a769622d21351c7bdce765b2cab2259f4879b1089aebc5c9f484260c8379e6398eb719db0546dc8e2b2fc4469f9a63ece347cac2d6fdf57dfd40707bf1f860c7a5430b29469b1eec1a9b7fa0273af76d987d1d6fdd8854bfcdd76c8e91c49865", @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040001,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c671337220359b71f726f75705f69643d", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f00000005c0)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0x8, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r3, &(0x7f00000020c0), 0x1000) r4 = syz_open_dev$audion(&(0x7f00000004c0)='/dev/audio#\x00', 0x3fc00, 0x0) setsockopt$inet6_mtu(r4, 0x29, 0x17, &(0x7f0000000500)=0x1, 0x4) write$FUSE_INIT(r3, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="757365722e2f644249e3da093fff0ce5626d6f77e3e75b900d92f02a7c426479294442b83295430005000000000200eec8ff47bc07538505ef6ca4ef09543f3684197f92e23930fd66f13d0e137a6b67867f69b597160ebdb147776d476b123f5a0f1740991fd5dcaf54a3aa2b2a95609cedab811a15477cced8afc513db935dbb8314f8a5d6a0ee6e5fb83214607042f556dc259d39612abd1266cbd3fb2f6acb8b17230f72b72ac9"], &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r3, &(0x7f0000001000), 0x1000) ioctl$TIOCLINUX2(r4, 0x541c, &(0x7f0000000540)={0x2, 0x4, 0x9, 0x2, 0x1, 0x7}) r5 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r5, 0x541b, &(0x7f0000000100)) [ 537.803780] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 537.813946] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 537.835140] overlayfs: unrecognized mount option "upperd8 cir=./file0" or missing value [ 537.879492] overlayfs: unrecognized mount option "upperd8 cir=./file0" or missing value 14:03:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000dd100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:15 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="2800000003000000000000000000000001000000000000000700000000000000757365721f696400"], 0x28) read$FUSE(r1, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r1, &(0x7f0000001000), 0x1000) [ 537.920303] overlayfs: './file0' not a directory 14:03:15 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x2000, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f00000002c0)={{0x95, @remote, 0x4e23, 0x2, 'wlc\x00', 0x36, 0xde2, 0x26}, {@local, 0x4e22, 0x1, 0x6, 0x61, 0x9}}, 0x44) r1 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) futimesat(r1, &(0x7f0000000240)='./file0\x00', &(0x7f0000000340)={{0x0, 0x2710}, {0x77359400}}) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:15 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xff0f) 14:03:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000223f00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 538.092593] overlayfs: './file0' not a directory 14:03:15 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000020b600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 538.175744] overlayfs: './file0' not a directory 14:03:16 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xa00000000000000) 14:03:16 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20004a00) 14:03:16 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0xea, 0x0) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:16 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000244200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:16 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000af01) 14:03:16 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000b0600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 538.734553] overlayfs: './file0' not a directory 14:03:16 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x4000000000000000) 14:03:16 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0xfffffffffffffffd, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) syz_mount_image$btrfs(&(0x7f0000000240)='btrfs\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x8, &(0x7f00000007c0)=[{&(0x7f0000000300)="8572b36887deba37c25150024adb0e1b9b39886fcbc1fdb05be4755b6b7a0c8d4a26b0f34c3ed355a2c073149a4f3b5fafdf66c8fbfcc7175e1f6a8de443bae4f4f5a21ed41c602e68088458da40b7b7da60d01834de77f2ea1f6190d2044e8c3c75986acfd033a05f935d8c18a3deb2c72a8105e8c9220e280543fb026b3a30761e88d18577b7f0", 0x88, 0xfc}, {&(0x7f00000003c0)="9a8d99792622863f102570dcbbf75655af1db8899678d8909e21ed816b271a67cb20c472a40bdbd38b239d8fa2fe5d19a22c5e69742b1d9bea1897f7f801208a0f24badc17e274f2015240af62d2bab7", 0x50, 0x7ff}, {&(0x7f0000000440)="9c4e06765fda279bd7fcbf96cb3ebd1a09f8fac047a0a7adbc232163db5fd94ec427830520c3fd208a8ffcd022f8dd3f79f20d3d68d17638d6fb2f14c009ae6e142eb98edbbe1304d759e1a079cf22cc330332373751892b2d12c91ee08981429da5d46c7dd37a6493786c3d34b43f98dc56807fccc9a9f4", 0x78, 0x3}, {&(0x7f0000000b80)="dd0ed26f6f6fe38c1622ecbe77cf3e488b1f7ec83e6fa2f5ccb87b362f3110eaaf5423ae1b3174c69a32f974f590e15d65bdb7117b3432dcedff7490674a84856ca6726c1791a3def08e1ff168af33cdac10ff79bf214a47de4caac36a476f6df4354e567f5fa730edbb6c2a9a001439fffb2f23061ed6ff005c63878c482c61c4071b28f14a8e0f9b7f673df37dd7a37d048b1501a12904cb080dc5487cbf591ef2f9b2ce07981e383e9fa077ba17ea63d0bba2d28d1beb510680622f6670e1b8cd7534f095f66703f6b26a8bc03e9e7008648ce82918475bb41aeb1e73f06312f344da807ed5dfc5e01668ce02703037ef0d57c9f402452ecc1a572674f6058f9a27328f9b68033164651b7bbb2cf715387a4d7cfcba093d096f2b91cc72ffbc9fbacd049e1e825b95b477fd469030553c386668ff266a68b80716d423f8e9e2be98f8c8320e93ac063452085935a4e6fd7877baa3cd18775a5def25080ec62a3928a35872e875c8e33474e5797075b1f037ba90afd5c5b9bf40e3e18a65e198fe3d190f9d6f708d99d58aaa12873d8734e4d61f47a03e2d5409feb6cc0e75c56b86f63d1c08f5258f7bb1d024504a7cbc829cb12c203b4b97a814cc94560203fac7b4a4f2172a100be29744a3587233f87dd806aa4c0a470b2c1be3ab8cb63abe0fdbecc251b31f5873b1b75c310b6d0bed04222026839ce8017a442edbbef45e7312778cf123d0bdc8ea7a1f51367e81a7649a6112a0d92d9379dc846a9a0b44f209283a10bfe196eb0fa561ef3e32bfd2f105562749b06e5ed35887c7d3cdfb11a4e43c7a8afde024444a896391c5393e17c591dc032d06843f231bfa12b3b96ce8e79d2fe43b6419d4bf63509ae6a8016713fb68b52d441a63a6f6631fcad49e52eb057670f8b2333574c3e8cb9f5010b94e417a5d70012a3cd42e98f4e4faa1fb68c22691cc4c4571ade99abb85c5e446188863e641d053e5f940914580ca1201fb595c0ef6b8c14215e0ce55fd321dcdd27af2178773926fe071051d7a4e216e2395bae78aaf492099ba4f09bbc5d4117c16c71cbc2c1ebc2d76b650fd66bebb0cbb3f5ec23b8979345c183e8fb001469f93784229511ff851ea000903f4b697fa90c815978b971f3a1a23daa270d1da3341826c73fc81098396c50132769a5270da35ed2ac6d72cd5c9b7ffc3da53da98e782a85617384bb9418ff22cec6ccdb32d950d679222fffa5013104b2e06e8e5a1a76deeaa8faba131620d3aa1760605317dc44be1bb18a93626b95c023b0752126fde28ffc808596daccb893749d8ec5dd52663a453339609d37ef15c715b9f36db9dec2a3c6a7abcb0c4f4ae683db800fd2bca7644385e69b64335b884a2b1d11f15ce379ba3cd7ac266543a4c2c6b42eb7fb15cfd3d8268ae8d525e2540b5c3d4e73b94adffeca82f147541bc112d850becac37ddeee17dc1330c800270e72df68af56a50550d8b5e1c385664a539b7bd884e0ce8649caa5c340281ccbc42469b1020c3a77bcbc6d05d98b24bbe9d84f4a1c4e7ad3966b5a1320d207bbc72965ed1d62c401b5ab087ab5e36edcb678a0a53661f01b26a0a770e73d351062fc5ce6e3afb0cfe8465ea1f543d372f23f5608903d9ba350c906f95cc0c927b5c2d7b2e32a9b4149f7109f3b46da71f44cd9c6cbf4c441392bcfe7204c84f0e6ac860022de7e4774f901c86385e4559f9ce1a160105fffbcecb57976df6157b3821b62a70e4d9eb2fc2898017d40b70a7284117c8026c1066b54661b764f49a6ee59f5b80db99d26b1a5c9287f35a8e03db55a13481055be98663b5d95a87d499906b4cbcff1cd72f73c342fe1f82fec9443bed43b7ad6536dbe15b4e562437202bce44fce17cc8d5a1c7d68224efef52fc2e26bf6ae341351ad08c236dc3c8d464a0b0cde2a4dbaf1c059f99ccdc8878b2f5210d60a5757773ef175c5f7d8c5edfcd34a48517529c6b147b022a6b4c97f7db66fad21b4619a73f8d9026186a70a561d48585e23dcbd192a10b675f0356911ba5f409d68add5670ccce07484006c675f384f797fd5521ae2a5f7096023cffd5c8954fe7dec762a167b43e462afaa03b09c191b0a02d30d89138e4fc1badb5e5010c2cfc8321557be58352dc5e8317076a17910ac67d1281cf99003de0f7430c0200d40f2fdb3e994eeff94ff9c4df7941cb70eb7f17994b5763429740d596bc36c201387b40e6b6f8fa83c234d0e85a0924de5a7adff94236969a8290790bab7fa1fa1efe31842e1a35a865a5b326e46aba6c69d0e9652f45cde07ef04ddf514de8abd185597150121f9c3cc4b56e3deb8b5db6b201d68f286ec005b7431b681c408deab3fdf99f17fccfe6ae923307fc29a14de60cea05d840dce4b5ef654726bc33be48f36c049fc28724d29ab563f2d23525313b6502ce03bbd2b0ca111adb1385a90208cc2f22feb077c5c80b6d10c3a14e6c44b282f6a5ec6d69205b2a3fe27cc6bc309cc5a59eca60584928e317abc1409bf42b492f532a72202b2083c7b65ba49c837c858598e80fa7a8574539eae44c5ec0f7c5d1ac345248c8dff67b46cb6cba4a6f30b94e79becf618bc02c1a9cec673ec966cdcd05f46a5c1200220c91efc130265bfa9b8a34f17519672c5b3acc8a198d16b60d9036698108c818ebc0c852574d1b099f55b51781b92c0e4c058201f81cb34e32a19b0608f05b80a238c2ec8ee231de7e93f826e2126065fdbd56bf55c4d0223becbf39abc15ac6660de38301dd76294503a4b81a8f151408610e6e65f80c9d6c9e109c848fd6705277aa9da42a7c5e2e8148308f9845be612ad8466d1d47324c6afd0fbca37167e3dfe867148340121cbd57dd0f8230afc4c5b9918ec33ed10cfdceb7ea65ced821814b1ef265f817379c6a79e7a11407be4e59f9be32a7e4f62eeb4ba77d1fdb89d1c314c1615f7a0ff25f4de904e8b80cf76c99ea2300689e4a956b85478dcd5817200ebdb9afe920aa637781637c17b316576cd4b1f5f4fad86a2c34811b68006a69a8c9b3db06af5c8afb48fa4a9488d740e0eca3a47f4b37968bad3df0ef0f8480c3e7af15aed2f4d66bee62fa805ffdb3a2e6d019c879012371318e91025f1cbc874384df05cba09173608f2b1433cfdecde83122440ac3f4f2986bddfec0d9e767dfb50b2b39a862c50bc17b62ce082aac733452eb1f34388c4cf8b4864b4cded53f0d34440133198f43c3a09b0931c6f452195c80ee0073464356a8ece2820dadfe9262015930cf696c4e57a00d46b28683f434fcd3094c348a017d278d685061c6ed55a6956ef3b356148ee37cd83d07c6435704677d5c7fa81343ca34d3b49c36b0c89f33ffa3df94695e388e98b2153a06e9031492ca8e97052a337358b3dae959368ddc098013837abb054d4dc8299f8e84873b02a452da3e75915ff5918a4f1c5df2f80906f8176e6a0a8bfcebbe8c4e7ce2b3c65e327eef8506114ebee3c841cab453aef2988a99baed3c2ca6d5145a3bec960109137c28a716d4fb22351a033ac299bfdb75acc479290343dae08393043ecdd4af6ab666411d9b90f5b88ea513d17e175a1a9ead5db244a10b349a10306f30c16dc4509d8a06a9ecb4c7d1c843a28393b98dd6586bb04ef1f073a50a2fcf9f69cd54f843bea918b8e357b10053627d1b3adcccd0c0de5266afbe7e0e1fa110927eaf57c87c72c26440518b065573c2be5b6c01d8c3088fed6542607582d49d01b68e44634180b9d9b7a47a321e209f7e0bb230ab0de981cc52710c903d2dbbc7552791a35544d71161898bff09947a9a4f8e57c3f68288cb8e7cad4f84fb3d8e758c3fa43cc221ab0ba8783c389d8c173ee096fb07391d69bb9294be35c58dbdda271aa602bb57a6d47088f061ea4920fc520dc6bc30ed15db0ed8bf8386f92f4a89b39cb389ad8406c28f9841d632a3409dcdb1e7a01b4e33db88a76d8cd3a1898ca930afbdce00294fb87a16fb10c234cd537bb2bed687ba9df9f40c4d66778551f8b3562c8a3558d029b1366977012fd81574a58cb14264568c04eb7297b5a787d481570c2a303cefccb35221d52a22c173f76486a38959926be886447335059ec3aac5a68a9d9a63d4c276dc056c6a23dc9b034fc66c603a99ae2ef22aecb296b4add39b52d12e185f6237d39baf7bac3c1f87d21c141828cde2037011d719f7a19a8d2a553c68c52d76efb8fae16d0af59edcca5bd4c045af623f4c2f57a5d5e5c02e7a91d144a4eccb4c11cf0dd15ea1d5ac4f0820d074fe0d789cecee72d79083571b257e9f2a2b35b27b90ff2861f81da63e85994392100c7bf59d91d6be8d52b8f8eeda31fc1c535cc03ac53a1425631dece975d53daaf366acfd1ad5b0f5fb9287baf8bdd4a133b6a60d41ed321571dd5a6f6515db642def043d266ce53f5792401da6faf3fb9fd56a8af1d0453432339bae3665d7fffc2383e242ee725ffefd0d7357512b5aaf8a0ad72dc3dcf72f5a13977a11406e04921546d3c163679b441b08a9c4113bec11ac0d65c87f67758c25010190ad277f0348651a5fd374b9914a365d66a42e2256c62f6d431bd064a21d18ba7ec83ab04a8cbab16fb16d371e96a412793b78ce82dfca3b0ad681f3aaaf47e443513529f908d924356201f71983606aaa5b7308a1f2363c7cc99a8706dfe7b4fb4d7ab031ef0a058c670534e0c8ea9142bbcf49a9080cdb716cba948cd662aa6dc6ba5119e97e15ed54ba271e7592bde55e2d0bdeb0ccfa6ce376b12c7f9c9507969324baafd657cba0cec8fb8ade7527a574a50422a87ec43a9726f8ad8f5181839b692ba80b137d7976e4f0029bd7851e5115f83345170f42ee12bcd4952df54a1f67fcf0825d7ebb904e5be549ef4b3af2a56d091776abd6d70c28f65d6d005115275ea861b4ec9d01be81b6563df15c6079a0d97287dbd3cad83f35d38fefd18db566cafb350b06c5950a2dbbb31e538bb08c50f925d54b4d7087e403054d12e9a7c0adcc7dd1be83548efc8176fda2b36cfc95b754d0718188c936987992773e7779b3ca4f331e6428b25b1b507928c36a682cd077108105e2ff3c9cabd7f11d0f95d85fb2b0572de80f1da7a64e59910663e8f74f738e29667727966331e46ba6a7cb9e3fd2fd67cecd52fe3cc033cc45a04aaffeb9c3be75078124210838b1ef9ba1b47e3d528d4f1fe787c14d9ed7f72a666e4627a3dc93d0d97871153012b8c1f64e1ac7053d809976cd5201967ed60d0a326f8f932d6da8ca4b5fcaaf68e2a9ab30845ceb2e6a4d459d5861fcf0eb91e89a31fa21d0345a30edbb15f05984fc831c60fa3bd1c8e6b28d24bb4a8017bf3ef7be12033520a8a2a8cdf48d581dc6d323ba893de6928c908ec71788fefb53cd1394fc39330f7a8ffe12232421b7b562af1627452a13d20094fe1dc09a943da9200d6b03830746cb169a18b4d80ef623de40297db92479a34f15e750c0a0ef5f146a88324ad8985602ebf884838b0e3d0d2cb1758643ead79140bea5ed0c98dd071b096c856dadb507f98a3be3fd35aa503b65bff79e3ef21266ddd7815af7a77d25ebf7e619258191f48707f0f0e0a97b5b9ae2cbfa0963975ecf433bf0688ef1bafe3eb66a00360cd5e895bb3885e361fd105e5c28f8864072043f556d055129f5bef3112617dc971fdbfc661c949dfc18aa7005c037f60873d9660652b8429a2ca2e94d8e9c7bdf826edab17d08419b757aa2519105f291f307e732c627dd49cf91614a0f88eafd8f182db05da4b4", 0x1000, 0x44}, {&(0x7f00000004c0)="6f849ec29127e98beaf21e6a48a68f83d0ab76005e39de2c1430998e35027f35eea464645ff048b48c76ee40097ca99c28d1f7804ebbdce6280b87d9d51acdff8eabf18020c692dd9e33fd507a825023b8fc1c66c0632d3b396e9538c9c90580214da54c2a062260bd6ba1f6dbda9dea58fbe7163357592e7d19dff637cd28e04e190e54d8d7f8eeeac44842219fc6c9433ae9e2bc07cec3b8650c84bcff72cd08b4db5b8335e11bc0ced363a91ca848abb62ef00fb9cf67484c42300d9f9ee4bdb2f4908203e323bc8604d69ab0671da3eb1fc849065d6231e06ae7046acde018ecb1be873bb12b08a80ff95b50515c", 0xf0, 0x5}, {&(0x7f00000005c0)="a5babfcb975526425f8c091841463fe67d21023252e6b38ce2e0c8099b45ad87e4c6bbbb041cd6ca4bcd51c2353f55f8f02f4a504230ddcf74c246c22b3882aad1f173087ad19844c02526cc4b4e614fd91f5c1a0169d32cf124b063a6e2cfddba23", 0x62, 0x4}, {&(0x7f0000000640)="e45291590fe070983fbd75db03df631e34fa5c9c6f08474bdd768f1b9a2af0843a189bd67647c1e160c8f1784c39b82064d1a41d91e504aa637108331ab3e0856e304782c0c423d7303dd2ba39c3f8fd09ebb21005d37047dab86d1155bc8385202c1026978cdfbb5e2e6568b29e", 0x6e, 0xfffffffffffffffb}, {&(0x7f00000006c0)="5e7e0587810d3a310e3660dedc87563ac05ba0e84a6a1e113fb675d32536a2e938c18965d007809cc3559bf8decf2c9c4e2098cce5e274ec451d5bf225addf425790ee27c26a48ee276649e71bc1dde0da2acd14495880fc5838267ecfcb77daca739280db5534c1d1d75bf50ce90881523b323b829164cf275cedd5847100d16182d71711e0d236c39b75c272f4cdcc5ac7ac41339076e09251195a53ef93ee0d85c9d84babdd831551c3995ebb8cb7bcd3c2cbb7989743c719563298ea91532eeaede8a2c692193946cc5651c4e323c3a2de61c183b56ad699828a9707e5eeff5d45c5759b833f441a4baf37dc1727342db27cae48ecf3a6db80074344", 0xfe, 0x3}], 0x800, &(0x7f0000000880)={[{@autodefrag='autodefrag'}, {@noacl='noacl'}, {@clear_cache='clear_cache'}, {@user_subvol_rm='user_subvol_rm_allowed'}, {@noflushoncommit='noflushoncommit'}, {@nobarrier='nobarrier'}, {@noflushoncommit='noflushoncommit'}, {@usebackuproot='usebackuproot'}], [{@dont_measure='dont_measure'}, {@permit_directio='permit_directio'}]}) r0 = creat(&(0x7f0000000940)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000140)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000002000)={{{@in6=@dev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f0000002100)=0xe8) syz_mount_image$gfs2(&(0x7f0000000080)='gfs2\x00', &(0x7f0000000980)='./file1\x00', 0x100000001, 0x7, &(0x7f0000001f40)=[{&(0x7f00000009c0)="ed88fc03966cdbfdf38213d003d04f82a8b0c2661317f2fe5d1aaf0cca5268af64c73a420c0b37fc4ec24ddc7125d73d56062805d31ba27a37a6851d744726d07e426a260dfafed3d7b7a72eb3660517cbb0e64e82840a69f8945e19a4647f5db8a255b0218367465066412b60a2dc8f92458bde3cd0191b7b88acf7d79885c4973e3789ae46cb468830db03ed40227ee64ce12d4d4608e90b9abf0a5ef62ffc3494c0dee76b2632119237d9baeb13e4a6e856873f1abba0797be75e7914a74ba6e45e7311a341974972dd78e0f31cdeba8c3fd31b25c5b671d6eefae3b3e4179461b0dd51ba4b82", 0xe8, 0x4}, {&(0x7f0000001b80)="cc825db2fc2eb69467a7ca628ee7331c61347cdccae0b1fc6e1e37a7ae059b1cf0807a68b761c5d244b0911638bcb17324bca60f416c9b9900388f28e66ca92ef0069f8895e3f455a21a5f010352454b0ddf403ee98f38ecaafbd46adbb96c25f5fd1a908bbfdae0e148c3fdc58aa68bb3f60e07773caa4774b2e6bcc5638b80403b987c807e36ccc0c64cbe7951de71a7076d0ffe71bdab6f4f3d598353cda56fcd189072bbeac85caa575838f0c3c4937eb7ad63046458", 0xb8}, {&(0x7f0000001c40)="6924ca00ee878a289eb6a9f12488f2143f037894f5db501865667efc9039211273", 0x21, 0x1}, {&(0x7f0000001c80)="5bda2f8c39f6ce138c07700dba2ac003c78c498b1034c73905a8fab82553bcb37bcf384f2d2609f419c0b1705c0f42f32b30ebe60f7dd9976af8795cb0097d5c60445a12dd822f0ddf606e7134c48c9fea6f798a10f878b6b4eed1ef945885bb663cad398a7a57b76bc77f2b9d015790625c0cab3e496ea374f37963463878eb0166ce24b8d8e78354137efa1e27f89bd7d3635b940095da293463b9741b8f2fa8a48f61f28617cb3be50875da888bb6321b821328309f281cc8ad2f73e31a1338e315d55bcdcb799d24b1383f9e6db9bea01452850c9ef6da8f436506", 0xdd, 0x8}, {&(0x7f0000001d80)="5b02bfff7e21c620b10f0af26fee1dea1c842bcea4d248037332ab", 0x1b, 0x7}, {&(0x7f0000001dc0)="d2a6d70aa10fe750780123e30b0a902636f1917253513a0770c8edd22608966e2bf636393cbb960cbee2e58c616f28e7121dd9c0a907f79c2afd94a4abd345889281e211ddd7d0c1adbff4a9b7378bbe764ceb99edae4450ea51565b456785f4ac5ccd485082cce5", 0x68, 0x80000001}, {&(0x7f0000001e40)="1083ed243227cbb7ebf809276f3a267c8b05a96f562e26e9755a209e75d3be740374d48de6b27feccbdf8765799450b209fee5da72fbe1b7282fe033b7475f3046bc4184900bbe7de1584d7b84177b75ea36fc09ec18021c06bd33b780b01439f16e9b3f42c4ff784e9a0663121710b329a9d19d4bdd43da2f84803639e0be8e4040b9ba43a02f45d7b2353adc646d639d76ac405802e5f057d8831f48ae46357716a5233282a23a405ece3b644280eafb850f2a01b53f6cc8b2a9148463178f941a00392b4221355d998f7e86f71afc522051559fe348b4906412a03c0d669b05e4bb6f7f09069f089a2336f12e5ad102535ba6a7d80554b2dd9fe755", 0xfd, 0x8000}], 0x41, &(0x7f0000002140)={[], [{@measure='measure'}, {@euid_gt={'euid>', r2}}]}) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:16 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x4000) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000030c0)={0x0, 0x1000, "b2dcc9fdc7b62de4c8e7028103fde4701f86128f472b4e124bc994c64f16ba9e78ba9701a0e034694d865cef7cf3b43c465e4324b7e28fbac908e4042401bb07e4a292543657562b9ba07276f4a2bace7831be8e12de563207eb7f660c53f5dfbcb722f371bc13b82f638c96776c7ef4b0daccef47731e772c376353ea352a8dbf1b093c10deab2a9ebfa3462dce9cf6cac2c538c92f0cd2497d4a432d4de3115569eac4723d045eb9b524abd6edde5283176af665f99470732d8dbf12d690ec0a59973cafa51648ae24d276d59b398d81569921646ad0ef11429254d1c51b6adda0627a9c175bbb17c9470189c720828bbf18420c3a78865d6f48f6c87e76607e143a7339f77ed4ae653d3813282985d52d310f7eda7adb0421dfbd6fbab723fc55866e1fe40e381a9e4f99b5bcbba9a7cdf9ce86b95fc74c87b75a556e31c350c0caabaa364c4452df17a2b56c78284f4fb4d1af466e96c4ba754f25484565f9a2c61f2b008ad74d1c32fb35e503bbf2984a7faef4d00b5d05047a04d624b108104a0fe49e50431566998d10fc9ccfdfa2d66f9adcb2a659088afe66dd5ab319da347d6292350b57b9941b5e4c34603bdb4129b9bb8edf958f5fb8bd3c0cf4870c7b444aee77d491415e6ccba4a009aa7c73fb433a1b9075e11a7e0f71aedc5c34f7e554ca6b0b0ed72d7cbfb8d6cc222bcfca1af4736b5fd89f6fd3d6e910a29d60f87afece33c955b2a8740ba0fd8fcdfce043c595faa0556cefdfc84bc1df8bd45ee05445f9ac55db5ef6c20b6ed10efc79f6c16a94619eb5eb602512b8857050bd8fc73c02573e11c066b03a66f20cd3f35595181cfa2e846e09f88b2b05184c7b88dc2a377ec73b794d0ab864ec0c320e4a7912d5a1e2e38212ef837b758a99ea60e25d1e92baf5806eb9136a104c3502f17458194bf96abd8fcb04807171f60dc6f0074d47cc7f7fa121acd2e4d869475bb8c53df6d720a16f542cf0185dceb3e5cd73be422126d6253c30bcce53fcc3b86965a40cf49548a1f6315f24b3b884d9ef64b9501828474dab67799e226cc114619db588581b5acaa3ca2c350cef41071e532c218383765db2296c280c93c6f10f6e41615615c47f04f7ab572709ac865a0e441f73cb428a1956cc1878ad38c9b144563b3faaac24112ce90e34899991527c815ea8a03eb380a79d789db35cf8084d9a719f34d93edc11b87b2d800cebd369c68138669796337d60593628cb5603b82f595d84ab34042eb5ba727b52f259b22c74f07c983ecd992a496e581fa4c0a9a9a54a144befa07c632bdaf8e0383db8aaf9629c1f2a07f454d02643a5543586cc07bc1ca4c7e786a575abf79447e590135a29d25686720f1f8862dd7ca7b6d8d1c4479c2aad49ee39cd1962e06108ac7b0aa581a6453dc51102fb2253608b95bec2da178e25a75e8053d39fce544a6cf46f1d7479a7fe0405077735a9fc96fee8bc803c41b269a7b079a450deb469e3ff83bfc2e0681f0da127ca224de6a1eb842639f2dab339f6b201105d010234bc532e69bb6965fadd4f14ddfea38d04bedc5afe1873149c914a3ad8952d5ac63b16ef2447a8e5dfd9a185770dc3d280ce0a1cee274660e2f45cec2d9508209bfc648534bc7a6d4073ffc3b6ec71135dee14cb29dbdcbe50851e9b992ce8e6e1c201e7b70a7afb29066f70fecd4e75515ab3d97dd1a617b533f96d1da1cb827f6c0593433669ae804c72b2a7b9420e5abb31f53dace44609ee84a9224d3d5f04d46b8cb9c80be3c1b4fe86021b5454b922f8757463107249be3783f809e84368d9dc8a4159b9b0d17a4359bc1bfb87198763cc8fbee3ced4ee1c63d62a1b767054410ae257617de3257503756708471a0deff3190764d69a7f3155df4ffc3c4b5b3b9d4e813f861bb294d56dd172639fea45ac49c4850c2f27135c041e05c1e031df60de7475263d08b957ce9e873cc9089d6d04e8c6acdc8a31c88f23931ee1c5ed7ee730b160b6af0cd599655eb964f138a32fe0e08c9a2981334c4f7dc490df4cbc6b688e5d66eefdbc4ef625f0337b34a01c9149570ce2819cf00bb921df18dcec3f1468d995158c3095e9f7cf3aaec56217ee6a6edc3506e52df9ac9cc1862f2171d6eab2df3437f30241f2fe08ae7ab5a005b7ab6024dfd97fe254920d641b5b11938e18669e8e5dc69e5d1dca34e099a7e621a03676efef515063e1172de18d9ee54455ddf3777e4152d2d14f411988a70d05ab6b1df38f6655c811f495179575bf4ca19cac812d7732b088d1091d15b5dda6e7e59c0668743c25bccf94596320c36c8310352f8b91ae1b9cc0c9ed609c1f26decded815da7ac53f11fc88c5d2fe551e6b97eb1fcebdc0a350965ec2771c2e4eb5668b01d339b689376b720a15e9945db69e93e5f32f0dd82826c394ad5de7d2beeb129d6527c51ec2c4a6b58e8c5762930ad67f9aab4de3af0ea35cb1386744bcef101b9c59d0993cb9f34f91f925caae1dcf9bcd19f0c098ad55259fd4e953b37fed0d120ea28d3c00a9631c01b00e0b2cf95dea7cd58a6ecc13d992cb8ab434b600bacff9220dd8acfc823d01095a1eca92996a8935ebd9c49221f39832c4e44629d9acc7fb2d6a5bacdd350b2f0c65f69a4f5abbaaa8233ec0a8cf98632965fd32f7a3660761961ae945f6f6e8d776129f5c2836fc33f433260e821039140722d9805b5ad258bf001d4d0b8fe9d0a0443f1f7c4b0f46dfe0fbca66493bceb66ebd3914be818559044033ba8b149009deb3e1eeea5fe087dbb636965e4a674027d46437e37b2beb462cc18be4a05bb33a808f774d9b81af5c9b77040af7153b36176f71c3dd2bfffde691cfcc5e62afadbc69b1f24576d85034263da001ef6d36310450c4e639de8d792bdc18cabfc2935bb1ec745db5c4ff5aab3c20a720dc3346c85e960ef37bfc8ad7dad95914059d890a095f7615a8b4f32e0123a7f72d6f28e569055302044cc6a94f524350b837c559fdbbe7dbb8520706ed8075e51eb3e4323d8ff4cb8e64f471c20879f9934ee30f619947e404d42483b45900ec4ee51184613e751db6d25c0ffce66596e34eaabda58877e74cd0a897cddbda90827f7d2574d8dc2e80316a43166b1355898e8184bc4fc71ea5eae5ab8184e982e9ca454b25a1461ce9cd61e842dd167b7aa3208d8f199d37288a1c36937e528d2a8b505b0a4c8cad8e38226e75592962bd2655e61d42672dc25ec05dadfe0b03d93abf8f93787b7cd24a5a4a1fd20db88e012c24236ead1e5092222679c3eb79aad530b0d9a193207a6ba4d93783933a3bb2a2d1639c89adf22f494c10322e060325b91563e9e8a2df9c04951726fe4604ecfaf5ff59d5fbaf5962568e28b606d0a534d768904913ec51c51308ad9e81021801ceaf030a6397924e874d4cbcaebf9409a2f89397108101566184cda31fb6d17e8c1da72a4ed249044fa83fab59ed1d18478590a5e242f9bddda2ece830872cced7d12f70ff6d50da29eb79848952cc7634fab3a15d299f30dca26a6c6fa579166d8221e54a501fdbf4087be12dae44338bd851624c4735d727b67d5f02d159aacca619935c9e79f288b7b127efc17a5f6a94aec7b02202827ad8c28e04e29d2c9e69f368f3588880e0a85a395de052655407ae8a98547d63ae1b1a1f9eb42b54a80e7533427d15d2a8e43ea8ce60532224a540c889abe8b109086ea4ddb3bf9f6b07b960b0f313c2324529166b8c35f15bcae583a48928754e7f48e878aa2c57115bc6460e03370cf143afde6ab448d05064adf68650227a1960a660c24c38ae13026eb94fd5842f67953cb4c08eefc6e78160a92e8ba8f243a1eb806381a27706036d6c5e4449f09b5e18d1f6e46b5efc67d5faff6451c29c22557317d835dbe7ce3297b6315e12e535a356bb54b6fd87abf74fac1cbc1fc8da7e12d46c4901d9045048af2cffcd9503811dd1824e8f2f957238138e08cd18f3db06b16e530f1baa6bbd7dab17ae140fc24567df27d8524fb01042c0ba70c3bdbed5a3f100dfe46da4e5a31270a3f72c6da74a2a04866ef48b22b17a9f8458020d9165f4b6393f670c6e8ad86c365f0703728e18633f32e38336330b4d6de21442d1946cb86a24ba7803d446ab4eef026ac2834ddadd20c2eee6c069b8103484d6da0a2d672a33fcfe5bf8a5996e8a5b8eac63e7f54e120ceb1188dbda19468e8382b9bd89e5b631575c5877fdff807c67f26118b679dfa64c8148b0196d0948eca9d40ee639fdff72398291a2d91fe8ef0422bbd1e8d47b554318c797cfa7a2d8c30d8cd3330b2ec63611f5110bb80885d7ffe174808769ba428b98dacd6071ebc1950e4126605f167195646822a8927864597de487f9cf5bb8e70cdbe4508e6c21fae0e5955a7434fa70529cbe794faeec73f8248cb845dff13cd8e9a86a747b707893d4d13c7887e7b13b7d283c0939ed62d04410ddee3ecc909d6ad71f218518551b34f1a9264c868ecb8c3e064c5d90b1f6d20c71c335005851ba595a09220976bea272eba5f63163d64c6104632da54a6d4f9bcf84b577f7d166a266f8f06c5013875055cb6dac049cae1c5e6fa4ef1effaed5a0abb50bd570fd3c7ed964d09c8d6fd7c5a5fc4a948fbd0ab0a917576e2cef46aeabf5f899a50bbc49b649b1405b59f4fb432495189cf6ff54d457a951fd53bac47bc7f4c1caf764bda398f95992588a93f4d61896d599762b8943e2b6005d3d8e364a15d5f73704550e05903c9f59cc463c6701ea352fc119f3d51776b1ee6d3151c3d1172c726588f7527348ccf9fd91188e7f1e2ca67eabfb825cf2c722f466bea0ab65b9f8961c171feb5bb5ef5fcb399bac67a83b8ed6d166fce78ce3874169369f47493c5ffbc5120191c2d6c67a16b8d812d905b185c7a06c238b45017766c8b7bc035a94631204839a00a68ef2dbe340405417c5a97a6b7e84b352ba43e8f190a7520a8020a141495bc769c38028af994280cfec4ed99bf81e676a90aab48cbcb44c9ff19f97832184d55723339cf7eeae23139607d862bd9935a96bf1d654bd70e2b63d7dd8671166dbd319ec2bc8206cbfba77d11595fa02101c2820d0862ec8a04292bf083327f1ac3a5b2cf07fcca778c056ed4402284c1e882e479b7f7fc981f4c763f2c6e2a449f4f99c0787d5d628383a6e1ecf5254bd5d81675b6b1a17e8fa16f087bd275b33fd83538d20460fddeca128947b7969303de92f16f272a9439c9c0d430361eddd124e0b7653a6f1e3f7b59f9aa195f9b65f8f0c4a07e5b10c71602601382900085c7179ff4e79e3292b96adad0f6763ee21746d219883ddbb2b26e73e82c099c9b50bd0806f806c339000cc7e4203302dc3db96c52907fafcea19e560d312a6c0ea4636a0f5f082f0bd9454bd3cdd9ec46116a7f904efc004c57a8f0834b2c12095ff375f72695a1eff14ad22c7761105a183b5a127ad9169ec294135e6327771f7e1ce1d1b1aae85baf34bd66f9154d0e2d90722f90971b3350a1d36f55273a60373616c30981cb07159abcbac28d007f4b96553fc59a0cd9ce5ee070828f4bd37e1763d73f1ffb16f15a0447a6327b8617bc99d93063d46d241bf2e24a818b2fc84158628dcb7c904a69fd26a7a13cc4a539fcf577ad3644980acf21dea62e3b3f0a78ac92612578b2d5bb86e3af0330cc3202a9ab433ebbf47bdbd885b1d434decbe08ce002c193a01f85e3b7a4d7d510665171fa6c998938bd5ee7fd3c606e43df25fad4be0f0ae7fe195dd069debc251a"}, &(0x7f00000001c0)=0x1008) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000200)={0x3, 0x6, 0x8208, 0x5, 0x7, 0x2, 0x289, 0xc7a, r2}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r3, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r3, &(0x7f0000000280)={0x50, 0x0, 0x1}, 0x50) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r3, &(0x7f0000001000), 0x1000) fdatasync(r3) 14:03:16 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001a6800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:16 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf6ffffff) 14:03:16 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffffeb) 14:03:16 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000bf500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 538.975680] gfs2: invalid mount option: measure [ 538.982187] gfs2: can't parse mount arguments [ 539.001635] overlayfs: './file0' not a directory 14:03:17 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20003e00) 14:03:17 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) r0 = accept4(0xffffffffffffff9c, &(0x7f00000002c0)=@pptp={0x18, 0x2, {0x0, @multicast1}}, &(0x7f0000000140)=0x80, 0x80000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000340)={0x0, 0x6e, "cb809d1e65dd1abe329f169c0d3c6c2192624ee03e65f9b9cd861feadeb05f4f2491ee1d6d8c57705997988e04ed965d69bd9a5021fe62f712adeadc5e0d8b12676c7282d413e229c0f78aca25482f94cc2be578f33549630c0496806624dbb33b1df8283bee587a167abfd39bc8"}, &(0x7f0000000240)=0x76) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000003c0)={r1, @in6={{0xa, 0x4e23, 0x1, @loopback, 0x1}}, 0x4, 0x1}, 0x90) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') open$dir(&(0x7f0000000480)='./file2\x00', 0x200000, 0x24) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:17 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001cab00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:17 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfeffffff00000000) 14:03:17 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000055) 14:03:17 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x400000000000000) 14:03:17 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$RTC_EPOCH_READ(r0, 0x8008700d, &(0x7f0000000140)) [ 539.597286] overlayfs: './file0' not a directory [ 539.604381] overlayfs: './file0' not a directory [ 539.725525] overlayfs: './file0' not a directory 14:03:17 executing program 5: r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @remote}, &(0x7f00000001c0)=0x1c, 0x80800) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0xc0, &(0x7f0000000480)=[@in6={0xa, 0x4e23, 0x1, @loopback, 0x5}, @in={0x2, 0x4e24}, @in={0x2, 0x4e24, @local}, @in6={0xa, 0x4e20, 0x6, @empty, 0x20}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1a}}, @in6={0xa, 0x4e24, 0x3, @mcast1, 0xce1}, @in={0x2, 0x4e20, @loopback}, @in6={0xa, 0x4e22, 0x3ff, @remote, 0x5}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000003c0)={r1, 0x7, 0x38, 0x1, 0x3, 0x90}, 0x14) r2 = syz_open_pts(0xffffffffffffff9c, 0x100) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000700)={0x37a, 0x8, 0x7, 0x6, 0x101, 0x100000001, 0x5, 0xc000000000000000, 0x1, 0x3, 0x7, 0x6}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000008c0)='/dev/vsock\x00', 0x802, 0x0) write$FUSE_IOCTL(r4, &(0x7f0000000900)={0x20, 0x0, 0x2, {0xf8, 0x0, 0x7, 0x4}}, 0x20) setxattr$security_smack_transmute(&(0x7f00000005c0)='./file0/../file0\x00', &(0x7f0000000600)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000640)='TRUE', 0x4, 0x2) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4001}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r6 = syz_open_dev$usb(&(0x7f0000000680)='/dev/bus/usb/00#/00#\x00', 0x3ff, 0x125040) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r6, 0x84, 0xf, &(0x7f0000000800)={r1, @in={{0x2, 0x4e21}}, 0x7, 0x4, 0x9f, 0x7fffffff, 0x200}, &(0x7f00000006c0)=0x98) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000380)=@known='com.apple.FinderInfo\x00', &(0x7f0000000340)='group_id', 0xffdc, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r5, &(0x7f0000000180)={0x28, 0x3, 0x0, {0x1, 0x7, 0x0, 'user_id'}}, 0x28) read$FUSE(r5, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r5, &(0x7f0000000280)={0xffffffffffffff5e, 0x0, 0x1}, 0x50) getsockopt$IP_VS_SO_GET_VERSION(r3, 0x0, 0x480, &(0x7f0000000540), &(0x7f0000000580)=0x40) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000007c0)=@random={'user.', '/dev/usbmon#\x00'}, &(0x7f0000000740)="256370e9572d9b57747970650019ba78a7e585d3e45297a42af309c7b4b608effd921dfefc9b7e86845ee5af0007bed2da09b31e29453c209549de83a7afafb478351686d918656f036a8c5dc3b739ead136c63e570c2549b22a66e48a515751a79d382e020f30", 0x67, 0x0) read$FUSE(r5, &(0x7f0000001000), 0x1000) 14:03:17 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000117100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:17 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = memfd_create(&(0x7f0000000640)='overlay\x00', 0x5) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000680), 0x4) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) socket$can_raw(0x1d, 0x3, 0x1) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r1 = creat(&(0x7f0000000300)='./file1\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) write$FUSE_WRITE(r1, &(0x7f0000000240)={0x18, 0x0, 0x2, {0x10000}}, 0x18) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x9, 0x1, 0x5, 0x1, 0x250d}, &(0x7f00000002c0)=0x14) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000340)={r3, 0x49c}, &(0x7f0000000380)=0x8) ioctl(r2, 0x8912, &(0x7f0000000140)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00000003c0)=0x6, 0x4) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:17 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xebffffff) 14:03:17 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000011d700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 539.887028] overlayfs: filesystem on './file0' not supported as upperdir 14:03:18 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000018b) 14:03:18 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:18 executing program 5: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000004c0)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000700)={0x16, 0x98, 0xfa00, {&(0x7f0000000340), 0x2, 0xffffffffffffffff, 0x0, 0x0, @ib={0x1b, 0x3f, 0x0, {"6d3a03a22ad13804238c25806cdd75ac"}}}}, 0xa0) fchmodat(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0x0) getsockopt$SO_COOKIE(0xffffffffffffffff, 0x1, 0x39, &(0x7f0000000540), &(0x7f0000000580)=0x8) ioctl$NBD_DO_IT(0xffffffffffffffff, 0xab03) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000200)={0x7, 0x8, 0xfa00, {r0}}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1f, 0x40, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000300)='./file0/file0\x00', &(0x7f0000000380)='./file0/file0\x00') getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000007c0)=ANY=[@ANYBLOB="af90931b9feacf9ed787bc62a9bc2b9cf1c8212009286a6a93ed9a1df7c153c66736d475044a385e623dc2137bc38904676dd3b1b4ecde58ec25180ec3035e5e3b710b28408708aa0c38b5056bc9629afd95dc58dfb9c8135855fdd80fea1bddddf0be73bd347deabf9ae31df8d3c1f2735b13e3aebe4b94c576618824196261f07e0b6756ca6bfec06f64fb62c7b7bce898e550b9d7fad1b0674cfb4852caf4405a0999b41f30fc32d4fd22435b6e3100c56dce581b3bca2e943fb1969bdb7cf59bd8b3"], &(0x7f00000002c0)=0x1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffff9c, 0x50, &(0x7f00000003c0)}, 0x10) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000240)={0x0, 0x1, 0x6, @local}, 0x10) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000100)='nfs\x00', 0x0, &(0x7f0000000000)) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$void(0xffffffffffffffff, 0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)=0x8) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x2000, 0x0) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r2, 0x84, 0x74, &(0x7f00000001c0)=""/141, &(0x7f0000000280)=0x2f2) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f00000000c0)={{0x2, 0x0, @multicast2}, {0x0, @broadcast}, 0x1c, {0x2, 0x0, @multicast1}, "8020e9ff00"}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_ifreq(r3, 0x8924, &(0x7f00000000c0)={'tunl0\x00', @ifru_names='vlan0\x00'}) 14:03:18 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfe000000) 14:03:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000018d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:18 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000054) 14:03:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000f7400637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 540.491731] overlayfs: './file0' not a directory 14:03:18 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf0ffffff) 14:03:18 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000300)='security.selinux\x00', &(0x7f0000000340)="73797374656d5f753a6f626a6563745f723a6d6f64756c219ed1fdcc672903c59c5a857965735f6465705f743a733000", 0x30, 0x3) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000140)={0x7, 0x8001, 0x0, 0x3, 0x993c, 0x6, 0x26, 0x6, 0x100000000, 0x5, 0xfffffffffffffff7}, 0xb) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000240)='/dev/qat_adf_ctl\x00', 0x200000, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f00000002c0)={'irlan0\x00', {0x2, 0x4e20, @remote}}) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000208a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:18 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xc000) [ 540.717170] overlayfs: './file0' not a directory 14:03:18 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65312c77bcfeb52669723d2e2f66696c6531ec6df15104b979a59b4681d0e8b4b1fdad2d682cda9cc2479d3195a4996d663af858c0fd7087f92efa2100f0a9547e87fb2dc2d3eafeea054f2baeb997a74b07913df97f7dc6fdca9f8d4b8278cb6b9ca22a4aa3be2787e7ff6ccc7cdcbf3686a4759142b363c8a128de701b0637755ffd9a5ff6623c97e5bb00682e213a7bbee68ea1e69f792a9cb9df88a0f705f1ed00f918fb22ea9fe39e0bb3679a0000ecf5978a3c5603a4d9b1e97b51be"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 540.872789] overlayfs: './file0' not a directory [ 540.932819] overlayfs: unrecognized mount option "w¼þµ&ir=./file1ìmñQ¹y¥›FÐè´±ý­-h" or missing value [ 540.975816] overlayfs: unrecognized mount option "w¼þµ&ir=./file1ìmñQ¹y¥›FÐè´±ý­-h" or missing value 14:03:18 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000193) 14:03:18 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000224000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:18 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x14) 14:03:18 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000040)='127.0.0.1\x00', &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='9p\x00', 0x0, &(0x7f0000000200)={'trans=rdma,', {'port'}}) 14:03:18 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000140)={0x1}, 0x8) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) socket$inet_smc(0x2b, 0x1, 0x0) 14:03:18 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000601) 14:03:19 executing program 5: r0 = syz_init_net_socket$bt_sco(0x1f, 0x3, 0x6) accept(r0, 0x0, &(0x7f00000005c0)) [ 541.329595] overlayfs: './file0' not a directory [ 541.351305] overlayfs: './file0' not a directory 14:03:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001f2f00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:19 executing program 5: unshare(0x40000000) r0 = openat(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000100)={{{@in=@loopback}}, {{@in6=@remote}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000000)=[{}]}, 0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 14:03:19 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000240)='overlay\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYRESOCT]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000000)={0xfff}, 0x4) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:19 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffffffffff0700) [ 541.495157] IPVS: ftp: loaded support on port[0] = 21 14:03:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000f1000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 541.558094] overlayfs: unrecognized mount option "01777777777777777777777" or missing value [ 541.589644] overlayfs: unrecognized mount option "01777777777777777777777" or missing value [ 541.600851] overlayfs: './file0' not a directory [ 541.648877] IPVS: ftp: loaded support on port[0] = 21 14:03:19 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000012e) 14:03:19 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xd00000000000000) 14:03:19 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file1\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") mkdir(&(0x7f0000000140)='./file1\x00', 0xa) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) setxattr$trusted_overlay_opaque(&(0x7f0000000240)='./file0/file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.opaque\x00', &(0x7f0000000300)='y\x00', 0x2, 0x1) 14:03:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000112800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:19 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0xff6d) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000b00)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000000), 0x8) write$binfmt_misc(r2, &(0x7f0000000040)={'syz1'}, 0xffcf) 14:03:19 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000c201) [ 542.172842] __ntfs_error: 36 callbacks suppressed [ 542.172851] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 542.202630] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:03:20 executing program 5: socket$inet(0x2, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f0000000080), 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000480)="0a0775b0d5e383e5b3c06639d476a0bf", 0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='smaps\x00') sendfile(r1, r2, &(0x7f0000000000), 0x7ffff000) 14:03:20 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x2000000000000) 14:03:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001ae600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 542.310148] ntfs: (device loop3): parse_options(): Unrecognized mount option ./file0/file0/file0. 14:03:20 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000240)={0x3, 0x1, 0x101}) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") write$P9_RRENAME(r0, &(0x7f0000000140)={0x7, 0x15, 0x1}, 0x7) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 542.442079] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:03:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000000f700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 542.500480] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:03:20 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = memfd_create(&(0x7f0000000640)='overlay\x00', 0x5) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000680), 0x4) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) socket$can_raw(0x1d, 0x3, 0x1) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r1 = creat(&(0x7f0000000300)='./file1\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) write$FUSE_WRITE(r1, &(0x7f0000000240)={0x18, 0x0, 0x2, {0x10000}}, 0x18) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x9, 0x1, 0x5, 0x1, 0x250d}, &(0x7f00000002c0)=0x14) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000340)={r3, 0x49c}, &(0x7f0000000380)=0x8) ioctl(r2, 0x8912, &(0x7f0000000140)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f00000003c0)=0x6, 0x4) truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 542.580127] overlayfs: './file0' not a directory [ 542.652357] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 14:03:20 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20004600) 14:03:20 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfeffffff) 14:03:20 executing program 3: mkdir(&(0x7f0000000140)='./file0\x00', 0x80) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000190900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:20 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x440400, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000240)) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f00000002c0)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:20 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000021) [ 543.058749] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 543.070183] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 543.082098] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 543.127312] overlayfs: './file0' not a directory 14:03:20 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000150d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 543.149500] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. 14:03:20 executing program 5: pivot_root(&(0x7f0000000380)='./file1/file0\x00', &(0x7f0000000340)='./file1/file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) mknod(&(0x7f00000002c0)='./file1/file0\x00', 0x140, 0x5) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000300)='./file1/file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:20 executing program 3: r0 = creat(&(0x7f0000000400)='./file0/file0\x00', 0x10) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000440)={&(0x7f00000003c0)='./file1/file0\x00', r0}, 0x10) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f0000000140)='./file1\x00', 0x0, 0x2, &(0x7f0000000300)=[{&(0x7f0000000240)="7931583bf93ebf86b583ca21d16a6a96961dce55985d4615e8cd9b03d3c81dccf797fad4794e02e85ee9baa05cdf5d13ae3a", 0x259, 0x5}, {&(0x7f0000000340)="74862e942b352c537f20954f32c0a40000000000f70000000000e09467fbc72dee818463df20e7fff5af9978227b13a507b395704b142fdda31a3168df32a9acb6c6559a92d75c4ecf8bab0b76", 0x4d, 0xfffffffffffffffa}], 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vsock\x00', 0xfffffffffffffffc, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000002c0)) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:20 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xc0) 14:03:21 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001e9300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 543.366177] overlayfs: './file0' not a directory 14:03:21 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xa1ffffff00000000) [ 543.418611] overlayfs: './file0' not a directory [ 543.605056] overlayfs: './file0' not a directory 14:03:21 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) read(r0, &(0x7f00000003c0)=""/115, 0x73) r1 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f00000002c0)={{0x0, 0x1, 0x7, 0x3, 0xfffffffffffffff9}, 0x6, 0x4, 'id1\x00', 'timer1\x00', 0x0, 0x8, 0x0, 0x3ff, 0x2d}) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:21 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002e01) 14:03:21 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001bea00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:21 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765726469723d2e2f66696c65312c5e6dd710f8aa4a776f726b6469723d"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000340)='./file1/file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:21 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf5ffffff00000000) 14:03:21 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001b7) [ 544.023286] overlayfs: unrecognized mount option "^m×øªJworkdir=" or missing value [ 544.046836] overlayfs: './file0' not a directory 14:03:21 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfbffffff) [ 544.071496] overlayfs: unrecognized mount option "^m×øªJworkdir=" or missing value 14:03:21 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000008700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:21 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0xfffffffffffffff7, &(0x7f00000002c0)="0000120000f06db8f63f2b659975088dcff6f7197dac6700") chdir(&(0x7f0000000280)='./file0\x00') time(&(0x7f0000000140)) unlink(&(0x7f0000000240)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:21 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000200)='./file1/file0/file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000140)='./file1/file0\x00', 0x8) 14:03:21 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000165b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:22 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x5260200) 14:03:22 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000380)='./file1/file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 544.443141] overlayfs: filesystem on './file0' not supported as upperdir [ 544.456157] overlayfs: './file0' not a directory 14:03:22 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000050200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:22 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001f2) 14:03:22 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0xfffffffffffffff7, &(0x7f00000002c0)="0000120000f06db8f63f2b659975088dcff6f7197dac6700") chdir(&(0x7f0000000280)='./file0\x00') time(&(0x7f0000000140)) unlink(&(0x7f0000000240)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:22 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffff7f) 14:03:22 executing program 3: rmdir(&(0x7f0000000140)='./file0\x00') mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="757070657264763b6ba50f66696c6530698a652f66696c6531000000000000000000000000000000000000000001000000"]) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) accept$unix(r0, &(0x7f00000002c0)=@abs, &(0x7f0000000340)=0x6e) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") fsetxattr$security_smack_entry(r1, &(0x7f0000000480)="000000008157eddede4e60cff8623f6a924525082d803e9fc8e9db0edac2a37371b79ab8e479f55b6fb60064ee8db86ab28c1031607fc6e5d90c466a1a6366bc277dc54cb46519db7cf662cbf1f14d790f1c455a7e43dc0300cea9ddcf3db6a773ccfb4fbab0735b19", &(0x7f0000000440)='vmnet1!\x00', 0x1055c, 0x2) chdir(&(0x7f00000003c0)='./file1/file1\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:22 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001df) [ 544.910981] overlayfs: unrecognized mount option "upperdv;k¥file0iŠe/file1" or missing value 14:03:22 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf4ffffff) 14:03:22 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x400, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f0000000240)={{0x101, 0x5}, 0x40}, 0x10) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:22 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0xfffffffffffffff7, &(0x7f00000002c0)="0000120000f06db8f63f2b659975088dcff6f7197dac6700") chdir(&(0x7f0000000280)='./file0\x00') time(&(0x7f0000000140)) unlink(&(0x7f0000000240)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 544.967034] overlayfs: unrecognized mount option "upperdv;k¥file0iŠe/file1" or missing value 14:03:22 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000158200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:22 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xd000000) [ 545.152160] overlayfs: './file0' not a directory 14:03:22 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000d2e00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:22 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0xfffffffffffffff7, &(0x7f00000002c0)="0000120000f06db8f63f2b659975088dcff6f7197dac6700") chdir(&(0x7f0000000280)='./file0\x00') time(&(0x7f0000000140)) unlink(&(0x7f0000000240)='./file0\x00') [ 545.271050] overlayfs: failed to resolve './file1': -2 14:03:23 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000013f) 14:03:23 executing program 3: mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x100, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f00000002c0)={0x0, 0x9, 0xff, &(0x7f0000000240)=0x3f}) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = add_key(&(0x7f0000000300)='rxrpc\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000380)="66d997e68b", 0x5, 0xfffffffffffffffa) keyctl$clear(0x7, r1) r2 = socket$inet6(0xa, 0x1000000000001, 0x0) getsockname$inet6(r2, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}, &(0x7f0000000400)=0x1c) ioctl(r2, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:23 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffffa1) 14:03:23 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000187300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:23 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0xfffffffffffffff7, &(0x7f00000002c0)="0000120000f06db8f63f2b659975088dcff6f7197dac6700") chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:23 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000015e) [ 545.811101] overlayfs: './file0' not a directory 14:03:23 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x7ffffffffffff) 14:03:23 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0xfffffffffffffff7, &(0x7f00000002c0)="0000120000f06db8f63f2b659975088dcff6f7197dac6700") unlink(&(0x7f0000000240)='./file0\x00') 14:03:23 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000032000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:23 executing program 3: mkdir(&(0x7f0000000340)='./file1\x00', 0x8) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) lsetxattr$security_selinux(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)='security.selinux\x00', &(0x7f0000000900)='system_u:object_r:ld_so_cache_t:s0\x00', 0x23, 0x1) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000140)) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000180)='./file0/file0/file0\x00') syz_mount_image$ntfs(&(0x7f0000000240)='ntfs\x00', &(0x7f00000002c0)='./file1/file0/file0\x00', 0xc6d, 0x7, &(0x7f0000000700)=[{&(0x7f0000000300)="6376e262f18b9b36a2849ca17b67441987ebdb608fb26dffbb43a3576acd3143315d6b967e99", 0x26, 0x6}, {&(0x7f0000000380)="e219002ea46ccf3e9a98ce2fabe59b2cceb5d25b965003fffe19f22ad44f617dc69a398ee6cd9bc91a87645129ba1d0a254b0465f2de178ff300e39fc13e11e45f8cb7794d80c7235d41ed3d178b7ccc390b020a6f", 0x55, 0xffffffffffffffff}, {&(0x7f0000000400)="e793ee81df92e0a0f7af5470e1fffa03d8d5eb87188cf666eb12bd403f767c3116b3a25a96001ff5d0ca71dac275c83159c439ab8776971cf36bef763df3e350f5dcdf6c1ed65b9d73661e71cf93e7c7049ddac16f69a7d13d90aa302a7396546120b20bcfbf30b15534cf647a56b3e6d85348c169c355e601cca960d613a246aa6b487d8b7d525e5953568d27f0a2f0830b96adfd5f2fb6d99fceb3593986808eef9cda21009a223ef26664def18cb8e26f0c77c06027dc9f1081706f", 0xbd, 0x7}, {&(0x7f0000000b80)="02c941e9ac2f86f86d42fa817a72fbf8be3f88352fd8ee1d4940635203b69d5487ef007e4ced3c234cc5d2721b27440b9e345a8f67afc21e098176342a83a2110d9c6351215c7ae2b73ef3678dd035804d244ce8ba0c627652bd0a412180b18d5891409b114b5529beffd39d8abc9d9905f515f78d82491cdf284f5f17e4a4b0b2597d666144a49d3029e78346239a33584ac00c6571b527549268fd43231be5bdd7ab3d7999a39ce852b4ebab1ccd325672aa5498f032b6838bf1f5300283d17ba7685f067fa75cd994c3591de809e1396007dd6ff05f46017d3da5135f0009fa5ee6b0fc1c3c88dffb0e960138409425fa4a8846a948764451b0a82235f80f1ae6b8a01be4832e558e3acde500052678e42c32754866297d0ae376e9be8c82e3999f18e79dd7a960ec97ce2034faceb1f3857f17b57c73ff914c2755342772af0b049829007df1caee1ca303e056fea75e9f63503b4fa4b6069f702d2709c3661abf15024170b4a00cdb15676d85167f37a8cf8e112ef4eafc10b7fd167417e685bc3955ce6f87346aa51b9923e6ae1ffb3c374a329670decde6ce1634a579c538eab7bbb9e296274f9641d32eaa3371b33d975037d9e3136484cb9e4e76643375687a1e09caf42c4cbc4bb96aad0b4713c45ccbf5f6e450bce5b936fd5427b895fd7a438d612fdae9444143ee216f72a12f2440a64d67fc764f6fb6b344105355ab9fbd160dc3ccf83888fc6bf762d26fccba6dc4455941f8d5e4392d7d91a3cb438686cbd68e1a1ffb66817f6c89e2124f79b7b55031e2e76c26bebc0f1ccf4c16c4717d1a5b648b4a2f9661ace7d2d6e7a3a8aa70edfff1d75482c6e258c8e8484c93d633bde6b1881ae32920c703ef4fefeef15fb9f5045fdfcc04c20c0580b5f5bccb357ab9bc6f2cde4122124b401424e817ed7908ab9fd09e3b34f44b834d5d94c5144dafd135739e4bb5f29d1220a5c41e3034543191b7c184bb03c5b14e4ee2a56098e2e6010e873be77c59486df5fd6826aa1d7cabd42f5d1a6065c47a25a16f93260e37402bddd030ac7279a162ecf9b5b6c143e787645ed3de461edfa9bee44235b9b061fb8c84e69a83fea94490efcd914ebeee698a803c730a3bcfd23a14211eed0552f3cd430fb7f1aaa8b276e612d80b57c50ec6828866e8c9c24b95f43e2f2df17d6d5ffe51341619d45c6db9f45fac14346c658f70c6ce8b7702882bd8c67c3abfbc5487ec5a3df51bbd95f9ffb0c7c92771d96fab0361a308368cc69ac0a68dd27f13c6d274008bffcdab393e340c06e4c46105b3d21d4fd93d246609b868254ea3b0f53adb53ebe69d98e469cb544f42629ba80f1c0c5d2823e734d3d1402f46f824469a3b3a6e81dc6011994b94f39efe25fb53cd011681c2c46cef5a14c29744f8160c3a5ca1fcc55837e071f4f4065660824af5e55d305d1cce8fdc065784bab60e92449284b630e197c7559a3d7b004903e8190feb78c74d5ae4fadd0a09a7d4388c8487ce979ac830f971dbd3be88f0226bc74cef25ec40d815ecc1509808fce7f2fb0818ed03f1e25b3ba67c613421a30ea489c2b892737b7cc157e59d31d85df142359b45e4c7cd851abe511ff9ead2188f26817ba1886c8719d0c330a9f045f88e15b11cc0ecdcf87da812b3903c22e3a1c0164f704bc594a2c056367b250ded86a905f381e8945309a93f79d069924e02c49b387973cca1507cdc69258cbb6f120c5c4d161446eec8d5a00f12fce653a0bbf0633da7958c5307031f7d40470e9e0e163b6adab2e6f806b49236802d0b58bda9ff908a6d8590432968a4a21574e7070602f47c4c03e30e970f453f721257f6e0d399d5422faa3b9c4c033c307f42627de175307405017689df3905ee99f14901f4380a5b5708a91bfe9c5820cfdd40ee5211e5f58ed62fa9d8fc67d0c6381ae8c1abe8341815eb0777edb8073e92a232064981400cca7f454e28b215d0fb7e046e80f9e8ec731f1044ec3cf9890a3acf34f1879b44937095d1f62b79ace057d8fdb2b42a0c256e2580128f8d56faba9573bc2a402440b7f5c39c0a96d3bc1120087badc15acf4369fbce5855ed8bf7e058cd73737d681aa34d429437bed1b51493d9ddaf079555a81f22d9cf5a532bbbbe0f76e6ca985aecc78083f3192ceee7535fd0e46a4e1e5457422bbb085e43a4479874f438d9df858c044db13181452f29e9294f1d44135490348cdaae4cc577bd33aa6f8dc49eda9b71fe8ffe8159e440a5e220cf1ac30dced74f1229f69345c64d70ebcc4bfdb0715e1ea216b43a714c6fe074d1952eb4638f0bf91458bdd118a343af89b2526708c1f1a1214d7d1bfa54a4653aead589ed22603e9958ca159f36b1f35ac746de98350fa8c1d6f95fbb74c99c8806e4089ecede1d74b5f845dcee941065b2a1cf5aa1b69e32dfbd7327e638a6017c2654269cf9fbd909575705cf4933db19216362e6a170e4130c7281e139fa8c4e2b4a4c3d888dc5d482d2d57fb5d52cafa709395c44bd701b6a7b2c09d50a898aef9067ed8e707ac231e2693cf423ed148d9725c0d579bdcdf97c1ebb641545b4b549aa18bfbdc43dde92463e301818f3e422678c1adf7a693d29b565c936c395c8be57dbb90d2e0c97944e1a57c818d5ce56444f045b6ae7a092d651baf67b0f7465541474938a1dba3d66c8bbe458e02c3df9a3011d510b39906aeee57359c54f9e6a44f270e384cb5e912ac9a966b073b5c2f211fa30e259be4ea99108fb04e2457af155de8602c44c71a06a5873b8afbc05059ea4568f9dbaf1c423ad2551ba19bc12a9f430d511c4bca827447180c2747cd8b1caf6570ec5d7feb835a6fb2966509fdf2a7b1ee24064097c7e8efde4fd4078b6356d1dad7f848aaac1fa9ad5281bc8e99bb82bb0de38564af94b407fb32c7183622c8be3395e16fd4ff3317d89667d16c205b5ad5249912ee27e5f58038c3f4f7e8e7a52716c24ed37ad6e9b0445415b7533a625fb392c4c93cf1d81903fdacfd2391cf4ebf41efec217362a26986f0a0dbaae8be72a4b45f2cf5b950069a1c5a615d04de4269018d9286c34bc71867daf6a1682f7c3155d7338f79fea1069d4f0f23d680b04734a98c32abe428c12053bf0c427200cbf955d53f8b454a498946b92c17310bb52153ceda16c134c11feb3fd1360b65e3573ac5f77b8c2dbadb4cb42aef00c19600e622f4709af97dd174a22c06dadfb88f113fdedd9c29b5f48a100747e9eb52ea50584730582cc1e952bea6662896e199a10749c692fcad1671c7b759ed7c570fd4b767295a64f266d5c6b84e3e809a74ad9681594e06f07eefad512282f33838bba30aaaaa44115cc1553114c27f021f91ae75577d5608affcc919d2151050e37d51dbfaee97ecd4b49956aff5d28e842ecd6a4ce4fe66ee9c7dbb32aaaa28f608aa785a54018295f89e3f362942356a830cd0c8f9c498c65f719a740385d8c4b200801b6f7c5c97602fd8ad1b6265c3c626e92800291916d70229056fd71c6b5106dc75d0968182c1e894dfedad977366e1c1ade66b64d2e4fbe37a3cba444a8cd72ae162307cd1e984f0d0c8136e20a7513a3fccca2a8d7472c7c7fbb578c91ed17df3253b4f13dcea3c5c1ef3e1f8618bd34300b876bc3ebbb8821534d91c6bf622eb6264274c697f18d395b80ecb56ecb38e6127e00f164b37949bbe7c2ddf1d4927ce4804f326919b8528c38b0011ab715a7ea1cf84a3a330090d1b19be3f4b4bc7d939e4a25b7f8417b5aa74f0883169d72db5a012f78d579a45d742537361d542e35ccfc30ee7d8806743bd072dfeaff89317f68a7ed043664ceb8118d569e6911d5dea502989e3ea37964a91f1b3e8a91f5d2959baf1ff176c5d4241e539998b819729b9f271fae778148b7b9846c02c8c7aa2dbe41eed732246af1515edb51d750ec33fd9866412e67e002b7e1c51299268cdbbe11d5b81810f5807acd9fd1e589dea8e3c70b549c8b7aeceae4e5cb33d6ec485cd08f16d67c41545c74ba2a477c1c861ec1ff1b3f8088c13e26361bf091d4f63f0845e29952bc8e4ee4b6d5e87eef954b132421274444d9d5dadeae551744c8f033de985608bbddb6868dbd977409b22335a19589ffeb4cab58911eec48640567a02c961941caa49a7ef5ab43c201c85e9afcb861ae04beffa04bb2359e3dbaf70600a5b73af8c68ba28994a4ca464c7efbfe505e55f0b22b75ab153e725fdd729336bf8fa8889c7e3ddaec730fc21dde311a1e4f9eae1711f5f867e79f875b637adb4a581a10a942600a1142e1f109b7a234516b567b13211e6b6bed21dc522a1640a7798bf32c22c0e27b095fef03debb9ba76e3e6c31e3e9601fd3761b4b18065862520e5230fc58ac43d49bef1866e61e8df0aff378c3788f9890fdc94bd6ddf8a2e6e3c4318fb1d54d3ef85ef28e8f155264cf34c6046287b3a18b27c7dd7890a4dc7ed1d5c6ecba11010908819793f89f87952842f673babdc81fdfcd9ddebec3e9d791b20b0e8647442fbc2b9d582d66f29a2d801366b7dcbdc1c2f22c121445734971e2afd333c797b6ed6f2311bf5332f0ebfae143b7317fc1c29187b1fb8f2210f0d4a6e03229a8dcbc85946ad5b21a37f8901f94da4dc7ce11f295b3aabf7bc3c3e64d2e4a269db49cb84ae003e1be93eb82892c609343c24a98f7bbd8992024670969bf877c40ccc7deeac855e321de341347614a7370dbf48bb3fead116c43638b847d8118394612ba7237b5d0e39bc60bb4695a740a7fc9ae5a55bd51b25ba045d69ec967e87d30c7e43d1e2609c7e57b1254c36f73cbd41d0464482e625950af94a3336c3d7f330b8fe9cc2d30576abcb9abb7ede8ee51655226aace1cc9ea84b6b09d0139e5a5fd8e9dfafd437299d0d9422977d81826fc33e23bc7b8af297c64ca3ca05aad570d0651333b8ab72246bc8e8288dfdb7fdea301a9155ceecda1806e004fa58973e5c72847858f0d5c9c2c37fe1e710de22425c101eff3e5db930f15401d0fc9966f8d926b0c6e8082c38699e17fc5da6f94be4b86ba1cb75a762512c1055d8a0ec894f60c37ee11d6937e15d4c6ee9fa939722188e58ca97bb351224dbd8333f9d3bdcd1cfdaf1b5a74807de569b8c1a175344e810deaf445086cbf7a9d56fb8981508ea729a72d6fc163420ab788c5cf5bde24e498b2fdf3083bf5d0cdce63ceb2d99f0bb66dcf8a3498f4c307e358cb4c11e74c1f3b8287671466ee8c89d707b84c70b39b7d1042adfc46492eff03307cda863fe0e108a42881af8f676f370bb58c48359f96ed762ddeeb7dde2b8174358596f510b95c8ce833769f8391e85d16729ba131ab8430c4143b2cc96e845611c486ec315d20c067aab37e424e2e387f7c5327f3892165eff9c6f1fddfd1bbc282a1d8df55df623196b9607836b34a92a57d9fb9aa07b13bbadd4441c61f1b957a8f852f47dfe67c73b03f7da3ab243ea347d3a31c843a9a472b6f158b94258f86688d98c07301a8a3caa3821d5479ec55372f40a1d577ce35cd52bd5fa094803d2927c74e0f36d980ebbf4a834fa4ba2433080577e7113b69866841a9c3ef81b186b178fad05a0fb11a0dfc4df5133e83c6b730ba018e3cd06fdbf90b5385610d09c166f61d55184cc6ad32ab30ca14b9f9ad49a8c784b67d451e033343540f19d47798f8e79d0ad01258ba5e5f8c031e52c4266824184694eb648772e34eaf3d1c6abdfb9508e674b23d65af1481e5aebe842fa3f6f199a9d42a575b752b6b62b81be0", 0x1000, 0xfffffffffffffffd}, {&(0x7f00000004c0)="aa37dfc213b5dd629678261fc018424053b591ed944f93fba778a832aaba2ce9ca3a05e3bec214153da37c13b471cfb18a85cf4a00a536c788f81749b087497ede2204b221f274fb194236", 0x4b, 0x8}, {&(0x7f0000000540)="e93737dcf24cf7fb4c9ce1f7d2b0476e682876496116d924a3b4ee55b2aeea2d8916dbad1994aff29a625eb744ec74a296ac4fcd8461935545db8c9783c5bdef6a478c05d4a224ff0afafc4b0c31f594d5d6f0b433699366dfb85b577d35f77a8ca8399e9160479bcfbfac4d13ec6701f62daf248be467831c36ff94193c1329ab9eea6a71ffa8ef8b2cad83", 0x8c, 0x83c9}, {&(0x7f0000000600)="3d43052dbde03c69df905c6cee9f6538471f7348393b998f672ab7b49757b1ce19df7cb5371492cd1e6c655909c697bf236059965f9cd428b0cc048936813f7fd73cbd6ed6849b6d214cca6aaaf37136fd0b27c633b41de0c3054c9e2799bfe8eee81110a18529509ae48754f9d1cadb7c74cd41a2fd801ca71f8fb5d6959d53a937067a253899d06303e3b8fc79a8f5bfa116652ed355590f6b2c5eaf513518e98de18ecdccd0819a321c14dd6644d494fde9a6301aa01a37dbc07fbc4575789bce40c84f096cd18a15120018", 0xcd, 0x2f5}], 0x800, &(0x7f00000007c0)={[{@errors_remount='errors=remount-ro'}, {@case_sensitive_yes='case_sensitive=yes'}, {@nls={'nls', 0x3d, 'macgreek'}}, {@mft_zone_multiplier={'mft_zone_multiplier', 0x3d, 0xffffffffffffffff}}, {@dmask={'dmask', 0x3d, 0x7}}, {@show_sys_files_no='show_sys_files=no'}, {@fmask={'fmask', 0x3d, 0x80000000}}], [{@measure='measure'}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}]}) truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:23 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xf6ffffff00000000) 14:03:23 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) socket$inet6(0xa, 0x1000000000001, 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 546.178181] overlayfs: './file0' not a directory 14:03:24 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000da00) 14:03:24 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000125f00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:24 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000580)='/dev/vcsa#\x00', 0xfffffffffffff0d1, 0x0) ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, &(0x7f00000005c0)={0x3, [0xffffffffffff9c5a, 0x8, 0x5]}) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65302c6c6f7765f141000000000000696c65312c776f726b6469413d2e2f66696c6531"]) r1 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@multicast1, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000000140)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}}}, &(0x7f0000000240)=0xe8) stat(&(0x7f00000004c0)='./file1\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(r2, r3, r4) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r5 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:24 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:24 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xebffffff00000000) 14:03:24 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20006400) 14:03:24 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:24 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000018d900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 546.677348] overlayfs: './file0' not a directory [ 546.678058] overlayfs: unrecognized mount option "loweñA" or missing value [ 546.716057] overlayfs: unrecognized mount option "loweñA" or missing value 14:03:24 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfe00000000000000) 14:03:24 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c6534723d2e2f66696c65312c776f726b00000000000000000000000000000002000000"]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x8) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) socket$inet6(0xa, 0x1000000000001, 0x0) chdir(&(0x7f0000000140)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:24 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000cdd00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:24 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 546.898464] overlayfs: unrecognized mount option "work" or missing value [ 546.920796] overlayfs: './file0' not a directory [ 546.930009] overlayfs: unrecognized mount option "work" or missing value 14:03:25 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000062) 14:03:25 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x500) 14:03:25 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="7570706572642f66696c65302c6c6f7765726469723d2e2f66696c65312c816f726b6469723d2e2f6669296531000000004142deef019c45d60c"]) r0 = syz_open_dev$usb(&(0x7f00000002c0)='/dev/bus/usb/00#/00#\x00', 0x5, 0x1c1800) ioctl$KVM_ASSIGN_DEV_IRQ(r0, 0x4040ae70, &(0x7f0000000300)={0x7fff, 0xffff, 0x916, 0x401}) socketpair(0x19, 0x5, 0x7, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$EXT4_IOC_RESIZE_FS(r1, 0x40086610, &(0x7f0000000240)=0x4) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000200)=@assoc_value={0x0, 0x12c0}, &(0x7f0000000340)=0x8) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f00000003c0)=r2, 0x4) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r3 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r3, 0x88912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000380)='./file1\x00', 0x4) 14:03:25 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000239200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:25 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:25 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20005800) [ 547.482307] __ntfs_error: 48 callbacks suppressed [ 547.482317] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 547.498208] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 547.533469] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 547.550300] overlayfs: unrecognized mount option "upperd/file0" or missing value 14:03:25 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:25 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000000e000637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 547.583173] overlayfs: './file0' not a directory [ 547.601060] overlayfs: unrecognized mount option "upperd/file0" or missing value [ 547.620667] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. 14:03:25 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:25 executing program 5: syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 547.685413] overlayfs: failed to resolve './file1': -2 14:03:25 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xd00) 14:03:25 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000dd500637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 547.770041] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 547.798195] ntfs: (device loop5): parse_options(): Unrecognized mount option ./file0. [ 547.813943] overlayfs: './file0' not a directory [ 547.858966] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 547.952675] overlayfs: './file0' not a directory [ 547.964333] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. 14:03:26 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000b1) 14:03:26 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) getsockname$llc(0xffffffffffffffff, &(0x7f0000000f00)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000f40)=0x10) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") ioctl$SG_GET_RESERVED_SIZE(0xffffffffffffffff, 0x2272, &(0x7f0000001140)) chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@mcast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f00000003c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000400)={{{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@loopback}}, &(0x7f0000000500)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000540)={{{@in=@rand_addr, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000000640)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000680)={{{@in6, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@local}}, &(0x7f0000000780)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000007c0)={{{@in6=@dev, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @loopback}}, 0x0, @in6=@local}}, &(0x7f00000008c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000900)={{{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000a00)=0xe8) r7 = geteuid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000b80)={{{@in6=@ipv4={[], [], @multicast1}, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000000a40)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000c80)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@local}}, &(0x7f0000000a80)=0xe8) stat(&(0x7f0000000d80)='\x00', &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = getegid() getgroups(0x2, &(0x7f0000000e40)=[0x0, 0x0]) r13 = getgid() getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000001040)={@dev={0xfe, 0x80, [], 0x20}, 0xfffffffffffffffc, 0x0, 0x0, 0xc, 0xfff, 0xb140, 0x5}, &(0x7f0000001080)=0x20) getgroups(0x5, &(0x7f0000000e80)=[0xffffffffffffffff, 0xee01, 0xee00, 0x0, 0xee01]) lstat(&(0x7f0000000ec0)='./file0\x00', &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$system_posix_acl(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)='system.posix_acl_default\x00', &(0x7f0000000f80)=ANY=[@ANYBLOB="02000000010001000000000002000600", @ANYRES32=r1, @ANYBLOB="02000100", @ANYRES32=r2, @ANYBLOB="02000500", @ANYRES32=r3, @ANYBLOB="02000300", @ANYRES32=r4, @ANYBLOB="02000600", @ANYRES32=r5, @ANYBLOB="02000100", @ANYRES32=r6, @ANYBLOB="02000200", @ANYRES32=r7, @ANYBLOB="02000100", @ANYRES32=r8, @ANYBLOB="02000700", @ANYRES32=r9, @ANYBLOB="040004000000000008000100", @ANYRES32=r10, @ANYBLOB='\b\x00\t\x00', @ANYRES32=r11, @ANYBLOB="08000400", @ANYRES32=r12, @ANYBLOB="08000100", @ANYRES32=r13, @ANYBLOB="08000600", @ANYRES32=r14, @ANYBLOB="08000400", @ANYRES32=r15, @ANYBLOB="10000200000000002000060000000000"], 0x9c, 0x1) 14:03:26 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:26 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xfffffffb) 14:03:26 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001ae100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:26 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001ce) [ 548.356864] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. [ 548.370505] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 548.415180] overlayfs: missing 'lowerdir' 14:03:26 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000002aa00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 548.444918] overlayfs: filesystem on './file0' not supported as upperdir 14:03:26 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:26 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xff01000000000000) 14:03:26 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:26 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000009a600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 548.608026] overlayfs: missing 'lowerdir' 14:03:26 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 548.726202] overlayfs: unrecognized mount option "lowerdir" or missing value [ 548.919395] overlayfs: './file0' not a directory 14:03:26 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000015d) 14:03:26 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,wor']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:26 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000234300637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:26 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x8000000000000000) 14:03:26 executing program 3: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001f2) [ 549.123136] overlayfs: unrecognized mount option "wor" or missing value [ 549.150083] overlayfs: './file0' not a directory 14:03:26 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000003e) 14:03:26 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=.']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:26 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000019a100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:26 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x30) [ 549.281532] IPVS: ftp: loaded support on port[0] = 21 [ 549.291992] overlayfs: workdir and upperdir must be separate subtrees 14:03:27 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000190200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:27 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./fi']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 549.432470] overlayfs: './file0' not a directory [ 549.450351] device bridge_slave_1 left promiscuous mode [ 549.455966] bridge0: port 2(bridge_slave_1) entered disabled state [ 549.465488] device bridge_slave_0 left promiscuous mode [ 549.471689] bridge0: port 1(bridge_slave_0) entered disabled state [ 549.487588] overlayfs: failed to resolve './fi': -2 14:03:27 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 549.555673] team0 (unregistering): Port device team_slave_1 removed [ 549.567991] team0 (unregistering): Port device team_slave_0 removed [ 549.569794] overlayfs: failed to resolve './file': -2 [ 549.582654] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 549.595534] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 549.629714] bond0 (unregistering): Released all slaves 14:03:27 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffffffffffff7f) [ 550.358677] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.365055] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.372106] device bridge_slave_0 entered promiscuous mode [ 550.395197] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.401626] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.408601] device bridge_slave_1 entered promiscuous mode [ 550.431264] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 550.454059] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 550.517086] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 550.541688] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 550.639309] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 550.646519] team0: Port device team_slave_0 added [ 550.669342] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 550.676554] team0: Port device team_slave_1 added [ 550.698188] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 550.723056] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 550.747262] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 550.771655] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 550.976943] bridge0: port 2(bridge_slave_1) entered blocking state [ 550.983296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 550.989946] bridge0: port 1(bridge_slave_0) entered blocking state [ 550.996324] bridge0: port 1(bridge_slave_0) entered forwarding state [ 551.723580] 8021q: adding VLAN 0 to HW filter on device bond0 [ 551.795321] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 551.867516] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 551.873622] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 551.881102] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 551.954800] 8021q: adding VLAN 0 to HW filter on device team0 14:03:30 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000e3) 14:03:30 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x4) 14:03:30 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000126900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:30 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) mkdir(&(0x7f0000000140)='./file1\x00', 0x12) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f00000003c0)=0xe8) fstat(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lchown(&(0x7f0000000240)='./file0/file0\x00', r2, r3) 14:03:30 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000440)=ANY=[@ANYBLOB="0400000000000000060b00380cb900839c000002000000000000004a0a00000000000004000000000000004d02000000000000000400000000000000000000000000000508000000000000e91b0200000000000000d8573d2ba252162d3c6dc96b7ebf07698d21f1785fb88d246847d8a798439ee581d719b3dc96eea761b7567d897af824e1e8c1db936a15bdd0dce6ddeb195c699d2091dbeb9910f954262a83ff61b18791eb56d7e8648848cd2cf7f4519367024e9c350b47c150db47b1e4f891c8adaa549271d5de5c89714305b40f993b72139fd76fc17b5d42a991dc3888960199c80b99b4e8774f5c4af652faacd34a1c36b618e87c0c2121d9612be40c591ba596265339df14014a875e2f205dcad019cbf7b38bd098ba7720f00f050da908c0c4bbebbd464f0463bd6ecffb16f2283576dbae378fecf271a3f2633bba"]) creat(&(0x7f0000000140)='./file0\x00', 0x19f) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) 14:03:30 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000015b) [ 553.218427] __ntfs_error: 16 callbacks suppressed [ 553.218436] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 553.235212] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 553.255972] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 14:03:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001d0200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:31 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) ioctl$EVIOCGPROP(r0, 0x80404509, &(0x7f00000002c0)=""/226) [ 553.334495] overlayfs: './file0' not a directory [ 553.353319] ntfs: (device loop2): parse_options(): Unrecognized mount option ./file0/file0. 14:03:31 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffffe4) 14:03:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000146900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:31 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x9, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x0) [ 553.473410] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 553.491811] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:03:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000f6b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 553.574372] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 14:03:31 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001db) 14:03:31 executing program 3: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x30) 14:03:31 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x1426000000000000) 14:03:31 executing program 5: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) lsetxattr$security_selinux(&(0x7f0000000ac0)='./file0/file0\x00', &(0x7f0000000b00)='security.selinux\x00', &(0x7f0000000b40)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') truncate(&(0x7f0000000200)='./file0\x00', 0x2000) 14:03:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000d8800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:31 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20005400) [ 554.058347] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 554.071749] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 554.081851] ntfs: (device loop5): ntfs_fill_super(): Unable to determine device size. 14:03:31 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x10000000000) 14:03:31 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001c5c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:31 executing program 3 (fault-call:5 fault-nth:0): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:32 executing program 5 (fault-call:1 fault-nth:0): mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) 14:03:32 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x200000) 14:03:32 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001c0b00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 554.402947] FAULT_INJECTION: forcing a failure. [ 554.402947] name failslab, interval 1, probability 0, space 0, times 0 [ 554.443304] CPU: 0 PID: 32577 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 554.450607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 554.459958] Call Trace: [ 554.462560] dump_stack+0x1c4/0x2b4 [ 554.466200] ? dump_stack_print_info.cold.2+0x52/0x52 [ 554.471395] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 554.477197] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 554.482741] ? pid_task+0x115/0x200 [ 554.486372] should_fail.cold.4+0xa/0x17 [ 554.490443] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 554.495549] ? lock_downgrade+0x900/0x900 [ 554.499698] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 554.505238] ? proc_fail_nth_write+0x9e/0x210 [ 554.509732] ? proc_cwd_link+0x1d0/0x1d0 [ 554.513792] ? kasan_check_read+0x11/0x20 [ 554.517944] ? kasan_check_write+0x14/0x20 [ 554.522185] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 554.527114] ? fsnotify+0xaae/0x12f0 [ 554.530834] ? fs_reclaim_acquire+0x20/0x20 [ 554.535165] ? lock_downgrade+0x900/0x900 [ 554.539316] ? ___might_sleep+0x1ed/0x300 [ 554.543463] ? arch_local_save_flags+0x40/0x40 [ 554.548052] __should_failslab+0x124/0x180 [ 554.552286] should_failslab+0x9/0x14 [ 554.556088] kmem_cache_alloc+0x2be/0x730 [ 554.560238] ? trace_hardirqs_on+0xbd/0x310 [ 554.564559] ? __ia32_sys_read+0xb0/0xb0 [ 554.568620] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 554.573986] getname_flags+0xd0/0x5a0 [ 554.577789] __x64_sys_unlink+0x35/0x50 [ 554.581768] do_syscall_64+0x1b9/0x820 [ 554.585652] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 554.591016] ? syscall_return_slowpath+0x5e0/0x5e0 [ 554.595945] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 554.600787] ? trace_hardirqs_on_caller+0x310/0x310 [ 554.605803] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 554.610819] ? prepare_exit_to_usermode+0x291/0x3b0 [ 554.615839] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 554.620689] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 554.625875] RIP: 0033:0x457579 [ 554.629079] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 554.647977] RSP: 002b:00007fc8058e0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 554.655689] RAX: ffffffffffffffda RBX: 00007fc8058e0c90 RCX: 0000000000457579 [ 554.662969] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 554.670237] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 554.677506] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058e16d4 [ 554.684772] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000004 [ 554.721842] overlayfs: './file0' not a directory 14:03:32 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000aa00) 14:03:32 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) 14:03:32 executing program 3 (fault-call:5 fault-nth:1): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:32 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000015ca00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:32 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x8000000) 14:03:32 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002c00) 14:03:32 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x4700) [ 555.020635] FAULT_INJECTION: forcing a failure. [ 555.020635] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 555.032493] CPU: 0 PID: 32627 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 555.039774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 555.049127] Call Trace: [ 555.051740] dump_stack+0x1c4/0x2b4 [ 555.055398] ? dump_stack_print_info.cold.2+0x52/0x52 [ 555.060599] ? __fdget_pos+0x1bb/0x200 [ 555.064499] should_fail.cold.4+0xa/0x17 [ 555.068566] ? _parse_integer+0x134/0x180 [ 555.072729] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 555.077849] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 555.083400] ? _kstrtoull+0x188/0x250 [ 555.087206] ? _parse_integer+0x180/0x180 [ 555.091363] ? lock_release+0x970/0x970 [ 555.095346] ? arch_local_save_flags+0x40/0x40 [ 555.099955] ? mark_held_locks+0x130/0x130 [ 555.099977] ? get_pid_task+0xd6/0x1a0 [ 555.099992] ? lock_downgrade+0x900/0x900 [ 555.100014] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 555.108128] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 555.108143] ? pid_task+0x115/0x200 [ 555.108156] ? find_vpid+0xf0/0xf0 [ 555.108172] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 555.108186] ? should_fail+0x22d/0xd01 [ 555.108206] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 555.145302] ? lock_downgrade+0x900/0x900 [ 555.149462] __alloc_pages_nodemask+0x34b/0xde0 [ 555.154145] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 555.159179] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 555.164124] ? fsnotify+0xaae/0x12f0 [ 555.167851] ? fs_reclaim_acquire+0x20/0x20 [ 555.172180] ? lock_downgrade+0x900/0x900 [ 555.172200] ? ___might_sleep+0x1ed/0x300 [ 555.172217] ? trace_hardirqs_off+0xb8/0x310 [ 555.172238] cache_grow_begin+0x91/0x8c0 [ 555.180530] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 555.180549] ? check_preemption_disabled+0x48/0x200 [ 555.180568] kmem_cache_alloc+0x665/0x730 [ 555.180587] ? trace_hardirqs_on+0xbd/0x310 [ 555.208029] getname_flags+0xd0/0x5a0 [ 555.211841] __x64_sys_unlink+0x35/0x50 [ 555.215831] do_syscall_64+0x1b9/0x820 [ 555.219726] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 555.225093] ? syscall_return_slowpath+0x5e0/0x5e0 [ 555.230023] ? trace_hardirqs_on_caller+0x310/0x310 [ 555.235036] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 555.240055] ? recalc_sigpending_tsk+0x180/0x180 [ 555.244806] ? kasan_check_write+0x14/0x20 [ 555.249044] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 555.253899] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 555.259089] RIP: 0033:0x457579 [ 555.262278] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 555.281173] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 555.288890] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 [ 555.296185] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 555.303459] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 555.310738] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 14:03:32 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x780) 14:03:32 executing program 5: mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8001, &(0x7f00000000c0)=0x209, 0x6, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) 14:03:32 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000080), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) 14:03:32 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000009fb00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 555.318007] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000006 14:03:33 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) r0 = creat(&(0x7f0000000080)='./file0\x00', 0x9) setsockopt$packet_buf(r0, 0x107, 0x17, &(0x7f0000000100)="605986cb178dc9dc097e5c548ac3e4f4a6535993548ae8acc1c2ba53758c022997660f4a2cbd0b8d989f7f4725505ead86fa9ad997e0cb688f1e7d32ccc67297709208763d1e6504a8ed3990e4fac7e4939a7b06efc71eb7d3128b109c31c8f7136f0fa3adb19abf728df7df8ca01b7f5a0cf385f2148744828b9a768beb08aa1109ded00bfb1de5a054853e7a50ca6c6e69c4fe23c8b9b69856ee5c9582dd59b9f13f81d6c71a7e085cbfed7091eebefe0c1188beece49ecab781e92d0f1c6ad149bd17769a72997c259624010223f64144f34d56c98c3bcd65c0dedd7a631edd46", 0xe2) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) [ 555.343651] overlayfs: './file0' not a directory 14:03:33 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20009f01) 14:03:33 executing program 3 (fault-call:5 fault-nth:2): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:33 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x100000) 14:03:33 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffd000/0x3000)=nil, 0x8000000000000002) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x280000, 0x0) 14:03:33 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000094700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:33 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000079) 14:03:33 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8005, &(0x7f00000000c0), 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) [ 555.948374] overlayfs: './file0' not a directory [ 555.956257] FAULT_INJECTION: forcing a failure. [ 555.956257] name failslab, interval 1, probability 0, space 0, times 0 [ 555.980718] CPU: 0 PID: 32686 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 555.988023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 555.997396] Call Trace: [ 556.000011] dump_stack+0x1c4/0x2b4 [ 556.003652] ? dump_stack_print_info.cold.2+0x52/0x52 [ 556.008866] should_fail.cold.4+0xa/0x17 [ 556.012962] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 556.018088] ? smack_privileged+0xd0/0xd0 [ 556.022239] ? walk_component+0x3fe/0x25c0 [ 556.026475] ? smk_curacc+0x7f/0xa0 [ 556.030103] ? smack_inode_permission+0x2bc/0x3b0 [ 556.034945] ? mark_held_locks+0x130/0x130 [ 556.039180] ? smk_curacc+0x7f/0xa0 [ 556.042819] ? smack_inode_permission+0x2bc/0x3b0 [ 556.047677] ? fs_reclaim_acquire+0x20/0x20 [ 556.052034] ? lock_downgrade+0x900/0x900 [ 556.056186] ? ___might_sleep+0x1ed/0x300 [ 556.060332] ? arch_local_save_flags+0x40/0x40 [ 556.064930] __should_failslab+0x124/0x180 [ 556.069164] should_failslab+0x9/0x14 [ 556.072969] kmem_cache_alloc+0x2be/0x730 [ 556.077123] __d_alloc+0xc8/0xcc0 [ 556.080575] ? shrink_dcache_sb+0x350/0x350 [ 556.084903] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 556.089932] ? d_alloc_parallel+0x1f40/0x1f40 [ 556.094420] ? mntput+0x74/0xa0 [ 556.097703] ? lookup_dcache+0x22/0x140 [ 556.101681] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 556.107144] ? mnt_want_write+0x3f/0xc0 [ 556.111122] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 556.116134] d_alloc+0x96/0x380 [ 556.119411] ? __d_lookup+0x9e0/0x9e0 [ 556.123211] ? __d_alloc+0xcc0/0xcc0 [ 556.126968] __lookup_hash+0xd9/0x190 [ 556.130771] do_unlinkat+0x3fe/0xa30 [ 556.134500] ? __ia32_sys_rmdir+0x40/0x40 [ 556.138643] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 556.144177] ? strncpy_from_user+0x3be/0x510 [ 556.148593] ? digsig_verify+0x1530/0x1530 [ 556.152824] ? kmem_cache_alloc+0x306/0x730 [ 556.157149] ? trace_hardirqs_on+0xbd/0x310 [ 556.161474] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 556.167009] ? getname_flags+0x26e/0x5a0 [ 556.171071] __x64_sys_unlink+0x42/0x50 [ 556.175044] do_syscall_64+0x1b9/0x820 [ 556.178938] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 556.184300] ? syscall_return_slowpath+0x5e0/0x5e0 [ 556.189266] ? trace_hardirqs_on_caller+0x310/0x310 [ 556.194321] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 556.199340] ? recalc_sigpending_tsk+0x180/0x180 [ 556.204096] ? kasan_check_write+0x14/0x20 [ 556.208332] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 556.213172] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 556.218359] RIP: 0033:0x457579 [ 556.221568] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 556.240465] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 14:03:33 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000007a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:33 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) get_mempolicy(&(0x7f0000000080), &(0x7f0000000100), 0x9, &(0x7f0000ffc000/0x2000)=nil, 0x1) 14:03:33 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x408) [ 556.248169] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 [ 556.255433] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 556.262694] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 556.269958] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 [ 556.277218] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000006 14:03:34 executing program 5: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) getsockname$inet(r0, &(0x7f0000000200)={0x2, 0x0, @loopback}, &(0x7f0000000240)=0x10) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4028641b, &(0x7f00000001c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1, 0x0, 0x4, &(0x7f0000ffc000/0x4000)=nil, 0x1}) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000100)=""/130) 14:03:34 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000014c200637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 556.432452] overlayfs: './file0' not a directory 14:03:34 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x2000f601) 14:03:34 executing program 3 (fault-call:5 fault-nth:3): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:34 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000080)) 14:03:34 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000114700637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:34 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffff8c) 14:03:34 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001ee) 14:03:34 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x700000000000000) 14:03:34 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000011f100637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:34 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x80, 0x0) timerfd_settime(r0, 0x1, &(0x7f0000000100)={{0x77359400}, {0x77359400}}, &(0x7f0000000140)) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) [ 556.876240] FAULT_INJECTION: forcing a failure. [ 556.876240] name failslab, interval 1, probability 0, space 0, times 0 [ 556.948113] CPU: 0 PID: 32747 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 556.955419] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 556.964800] Call Trace: [ 556.967408] dump_stack+0x1c4/0x2b4 [ 556.971056] ? dump_stack_print_info.cold.2+0x52/0x52 [ 556.976273] should_fail.cold.4+0xa/0x17 [ 556.980360] ? __kernel_text_address+0xd/0x40 [ 556.984871] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 556.990000] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 556.995030] ? mark_held_locks+0x130/0x130 [ 556.999286] ? kasan_check_read+0x11/0x20 [ 557.003432] ? __zone_watermark_ok+0x330/0x7b0 [ 557.008012] ? kasan_check_write+0x14/0x20 [ 557.012256] ? prep_compound_page+0x26c/0x390 [ 557.016754] ? fs_reclaim_acquire+0x20/0x20 [ 557.021073] ? lock_downgrade+0x900/0x900 [ 557.025224] ? ___might_sleep+0x1ed/0x300 [ 557.029374] ? arch_local_save_flags+0x40/0x40 [ 557.033955] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 557.039499] __should_failslab+0x124/0x180 [ 557.043732] should_failslab+0x9/0x14 [ 557.047532] kmem_cache_alloc+0x2be/0x730 [ 557.051681] __d_alloc+0xc8/0xcc0 [ 557.055137] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 557.060151] ? __isolate_free_page+0x610/0x610 [ 557.064730] ? trace_hardirqs_on+0xbd/0x310 [ 557.069055] ? ima_match_policy+0x848/0x1560 [ 557.073459] ? lock_downgrade+0x900/0x900 [ 557.077608] ? mark_held_locks+0x130/0x130 [ 557.081844] ? mark_held_locks+0x130/0x130 [ 557.086080] ? __wake_up_common_lock+0x1d0/0x330 [ 557.090840] ? __wake_up_common+0x7d0/0x7d0 [ 557.095159] d_alloc+0x96/0x380 [ 557.098456] ? __d_alloc+0xcc0/0xcc0 [ 557.102191] d_alloc_parallel+0x15a/0x1f40 [ 557.106423] ? mark_held_locks+0x130/0x130 [ 557.110660] ? mark_held_locks+0x130/0x130 [ 557.114902] ? __d_lookup_rcu+0xaa0/0xaa0 [ 557.119072] ? mark_held_locks+0x130/0x130 [ 557.123304] ? smk_access+0x53b/0x700 [ 557.127116] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 557.132650] ? __d_lookup+0x591/0x9e0 [ 557.136446] ? lock_downgrade+0x900/0x900 [ 557.140605] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 557.146400] ? smk_tskacc+0x3dd/0x520 [ 557.150199] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 557.156011] ? __lockdep_init_map+0x105/0x590 [ 557.160505] ? __lockdep_init_map+0x105/0x590 [ 557.164997] ? lockdep_init_map+0x9/0x10 [ 557.169057] ? __init_waitqueue_head+0x9e/0x150 [ 557.173724] ? init_wait_entry+0x1c0/0x1c0 [ 557.177965] __lookup_slow+0x1e6/0x540 [ 557.181851] ? vfs_unlink+0x510/0x510 [ 557.185653] ? down_read+0xb0/0x1d0 [ 557.189280] ? lookup_slow+0x49/0x80 [ 557.192994] ? __down_interruptible+0x700/0x700 [ 557.197658] ? d_lookup+0x221/0x340 [ 557.201288] ? inode_permission+0xb2/0x560 [ 557.205535] lookup_slow+0x57/0x80 [ 557.209075] lookup_one_len_unlocked+0xf1/0x100 [ 557.213740] ? lookup_slow+0x80/0x80 [ 557.217478] ? lock_downgrade+0x900/0x900 [ 557.221637] ovl_lookup_single+0x63/0x870 [ 557.225784] ovl_lookup_layer+0x3cf/0x4a0 [ 557.229938] ? kasan_check_write+0x14/0x20 [ 557.234172] ? override_creds+0x195/0x1f0 [ 557.238320] ? ovl_dentry_upper+0x65/0x120 [ 557.242563] ? ovl_lookup_single+0x870/0x870 [ 557.246969] ? ovl_path_real+0x400/0x400 [ 557.251029] ? kasan_slab_alloc+0x12/0x20 [ 557.255179] ovl_lookup+0x5cf/0x29c0 [ 557.258911] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 557.263935] ? ovl_path_next+0x2e0/0x2e0 [ 557.267999] ? do_raw_spin_unlock+0xa7/0x2f0 [ 557.272406] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 557.276985] ? kasan_check_write+0x14/0x20 [ 557.281217] ? do_raw_spin_lock+0xc1/0x200 [ 557.285447] ? _raw_spin_unlock+0x2c/0x50 [ 557.289590] ? d_alloc+0x290/0x380 [ 557.293135] ? __d_alloc+0xcc0/0xcc0 [ 557.296854] __lookup_hash+0x12e/0x190 [ 557.300740] do_unlinkat+0x3fe/0xa30 [ 557.304454] ? __ia32_sys_rmdir+0x40/0x40 [ 557.308612] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 557.314164] ? strncpy_from_user+0x3be/0x510 [ 557.318575] ? digsig_verify+0x1530/0x1530 [ 557.322806] ? kmem_cache_alloc+0x306/0x730 [ 557.327135] ? trace_hardirqs_on+0xbd/0x310 [ 557.331469] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 557.337025] ? getname_flags+0x26e/0x5a0 [ 557.341084] __x64_sys_unlink+0x42/0x50 [ 557.345060] do_syscall_64+0x1b9/0x820 [ 557.348943] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 557.354301] ? syscall_return_slowpath+0x5e0/0x5e0 [ 557.359231] ? trace_hardirqs_on_caller+0x310/0x310 [ 557.364297] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 557.369326] ? recalc_sigpending_tsk+0x180/0x180 [ 557.374079] ? kasan_check_write+0x14/0x20 [ 557.378313] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 557.383153] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 557.388347] RIP: 0033:0x457579 [ 557.391551] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 557.410448] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 557.418153] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 [ 557.425419] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 557.432678] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 557.439940] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 14:03:35 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x7fff, 0x1b0, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) 14:03:35 executing program 3 (fault-call:5 fault-nth:4): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 557.447201] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000006 [ 557.458927] overlayfs: failed to resolve './file1': -2 [ 557.489681] overlayfs: failed to resolve './file1': -2 14:03:35 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000e4d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 557.654786] FAULT_INJECTION: forcing a failure. [ 557.654786] name failslab, interval 1, probability 0, space 0, times 0 [ 557.678505] CPU: 0 PID: 309 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 557.685626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 557.694990] Call Trace: [ 557.697608] dump_stack+0x1c4/0x2b4 [ 557.701278] ? dump_stack_print_info.cold.2+0x52/0x52 [ 557.706471] ? __brelse+0x104/0x180 [ 557.710098] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 557.715651] should_fail.cold.4+0xa/0x17 [ 557.719708] ? ext4_xattr_get+0x1a8/0xb30 [ 557.723850] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 557.728953] ? ext4_xattr_inode_set_class+0x60/0x60 [ 557.733973] ? up_read+0x1a/0x110 [ 557.737421] ? ext4_xattr_get+0x1ad/0xb30 [ 557.741567] ? d_alloc_parallel+0x1f40/0x1f40 [ 557.746062] ? fs_reclaim_acquire+0x20/0x20 [ 557.750385] ? lock_downgrade+0x900/0x900 [ 557.754533] ? ___might_sleep+0x1ed/0x300 [ 557.758679] ? arch_local_save_flags+0x40/0x40 [ 557.763257] ? ext4_xattr_trusted_set+0x40/0x40 [ 557.767983] ? __vfs_getxattr+0xf6/0x150 [ 557.772047] __should_failslab+0x124/0x180 [ 557.776289] should_failslab+0x9/0x14 [ 557.780108] kmem_cache_alloc_trace+0x2d7/0x750 [ 557.784766] ? vfs_getxattr+0xc4/0x390 [ 557.788665] ? xattr_permission+0x310/0x310 [ 557.792997] ovl_encode_real_fh+0xca/0x500 [ 557.797230] ? ovl_set_attr+0x550/0x550 [ 557.801203] ? ovl_check_metacopy_xattr+0x79/0x140 [ 557.806143] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 557.811699] ? ovl_lookup_single+0xd0/0x870 [ 557.816021] ovl_get_index_name+0x1c/0x80 [ 557.820183] ovl_lookup_index+0xe4/0x700 [ 557.824260] ? ovl_get_index_fh+0x2d0/0x2d0 [ 557.828577] ? ovl_path_real+0x400/0x400 [ 557.832635] ? kasan_slab_alloc+0x12/0x20 [ 557.836781] ? ovl_lookup+0x1178/0x29c0 [ 557.840754] ovl_lookup+0x9f2/0x29c0 [ 557.844478] ? ovl_path_next+0x2e0/0x2e0 [ 557.848545] ? do_raw_spin_unlock+0xa7/0x2f0 [ 557.852952] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 557.857531] ? kasan_check_write+0x14/0x20 [ 557.861762] ? do_raw_spin_lock+0xc1/0x200 [ 557.866012] ? _raw_spin_unlock+0x2c/0x50 [ 557.870158] ? d_alloc+0x290/0x380 [ 557.873718] ? __d_alloc+0xcc0/0xcc0 [ 557.877430] __lookup_hash+0x12e/0x190 [ 557.881320] do_unlinkat+0x3fe/0xa30 [ 557.885040] ? __ia32_sys_rmdir+0x40/0x40 [ 557.889188] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 557.894728] ? strncpy_from_user+0x3be/0x510 [ 557.899141] ? digsig_verify+0x1530/0x1530 [ 557.903374] ? kmem_cache_alloc+0x306/0x730 [ 557.907691] ? trace_hardirqs_on+0xbd/0x310 [ 557.912029] ? __ia32_sys_read+0xb0/0xb0 [ 557.916092] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 557.921627] ? getname_flags+0x26e/0x5a0 [ 557.925682] __x64_sys_unlink+0x42/0x50 [ 557.929656] do_syscall_64+0x1b9/0x820 [ 557.933538] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 557.938912] ? syscall_return_slowpath+0x5e0/0x5e0 [ 557.943837] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 557.948677] ? trace_hardirqs_on_caller+0x310/0x310 [ 557.953689] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 557.958700] ? prepare_exit_to_usermode+0x291/0x3b0 [ 557.963718] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 557.968787] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 557.973984] RIP: 0033:0x457579 [ 557.977176] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 557.996074] RSP: 002b:00007fc8058e0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 14:03:35 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000099) 14:03:35 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x45, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000100), &(0x7f0000000300)=0xc) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x2, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x100b}}, 0x20) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000340), &(0x7f0000000380)=0x40) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f00000001c0)={0x6, 0x118, 0xfa00, {{0x7, 0x6, "6540d8925558142ad82e7383182a9e817d3da5ee6353a018753da3810d363a8e6c1c8c53af826965f56eed51490fc2b3e2ee275b1f1e2266a52d1f7e48950031621eb8af55f3e8eb852f2522cf81b6d5b7cb0cd0b23b52772dce2f5c70dcd6ce8f8abbcd58d5f427b09b65599e377aba5628aad94e58cdd3da14182c13640cc11728b1e8c36a68fcbfdcc663f71169ed7fd948bb20a4adb1ccc418d95472f0b7bab49c6153be00ccd9ff31c2fa22f1a1136aa483df4a5d46771dff72d9c2b81580be88b868a33b270a3534a573d8447df05d957d5a2d96e6da6fd55c6c12ab2b0cc5c6528d381af0c3c43539922d8926d13f6195bdf90dc0cfa1666f5eadf7a8", 0x67, 0x4, 0x6, 0x101, 0x6, 0x9, 0x1}, r2}}, 0x120) pkey_alloc(0x0, 0x0) get_mempolicy(&(0x7f0000000180), &(0x7f0000000140), 0x3f, &(0x7f0000ff9000/0x4000)=nil, 0x0) 14:03:35 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0xffffffff00000000) 14:03:35 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20002800) 14:03:35 executing program 3 (fault-call:5 fault-nth:5): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 558.003780] RAX: ffffffffffffffda RBX: 00007fc8058e0c90 RCX: 0000000000457579 [ 558.011056] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 558.018319] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 558.025579] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058e16d4 [ 558.032840] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000004 14:03:35 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x4080, 0x0) setsockopt$inet_dccp_int(r0, 0x21, 0x5, &(0x7f0000000080)=0x100000000, 0x4) get_mempolicy(&(0x7f0000000100), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x6) [ 558.115248] overlayfs: './file0' not a directory 14:03:35 executing program 5: mbind(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, &(0x7f0000000080)=0xfffffffeffffffff, 0x8, 0x2) mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x8041, &(0x7f0000000100)=0xfdfffffffffffffd, 0x8000041, 0x1) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) openat$userio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/userio\x00', 0x301001, 0x0) 14:03:35 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x800000000000000) [ 558.208632] FAULT_INJECTION: forcing a failure. [ 558.208632] name failslab, interval 1, probability 0, space 0, times 0 14:03:35 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000b1a00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 558.249098] CPU: 0 PID: 339 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 558.256219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 558.265576] Call Trace: [ 558.268177] dump_stack+0x1c4/0x2b4 [ 558.268199] ? dump_stack_print_info.cold.2+0x52/0x52 [ 558.268231] ? __brelse+0x104/0x180 [ 558.280662] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 558.286205] should_fail.cold.4+0xa/0x17 [ 558.290275] ? ext4_xattr_get+0x1a8/0xb30 [ 558.294435] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 558.299551] ? ext4_xattr_inode_set_class+0x60/0x60 [ 558.304580] ? up_read+0x1a/0x110 [ 558.308038] ? ext4_xattr_get+0x1ad/0xb30 [ 558.312185] ? d_alloc_parallel+0x1f40/0x1f40 [ 558.316681] ? fs_reclaim_acquire+0x20/0x20 [ 558.321003] ? lock_downgrade+0x900/0x900 [ 558.325154] ? ___might_sleep+0x1ed/0x300 [ 558.329303] ? arch_local_save_flags+0x40/0x40 [ 558.333884] ? ext4_xattr_trusted_set+0x40/0x40 [ 558.338563] ? __vfs_getxattr+0xf6/0x150 [ 558.342626] __should_failslab+0x124/0x180 [ 558.346863] should_failslab+0x9/0x14 [ 558.350671] kmem_cache_alloc_trace+0x2d7/0x750 [ 558.355333] ? vfs_getxattr+0xc4/0x390 [ 558.359216] ? xattr_permission+0x310/0x310 [ 558.363536] ovl_encode_real_fh+0xca/0x500 [ 558.367770] ? ovl_set_attr+0x550/0x550 [ 558.371782] ? ovl_check_metacopy_xattr+0x79/0x140 [ 558.376738] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 558.382284] ? ovl_lookup_single+0xd0/0x870 [ 558.386603] ovl_get_index_name+0x1c/0x80 [ 558.390748] ovl_lookup_index+0xe4/0x700 [ 558.394805] ? ovl_get_index_fh+0x2d0/0x2d0 [ 558.399127] ? ovl_path_real+0x400/0x400 [ 558.403181] ? kasan_slab_alloc+0x12/0x20 [ 558.407332] ? ovl_lookup+0x1178/0x29c0 [ 558.411310] ovl_lookup+0x9f2/0x29c0 [ 558.415038] ? ovl_path_next+0x2e0/0x2e0 [ 558.419102] ? do_raw_spin_unlock+0xa7/0x2f0 [ 558.423506] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 558.428084] ? kasan_check_write+0x14/0x20 [ 558.432336] ? do_raw_spin_lock+0xc1/0x200 [ 558.436582] ? _raw_spin_unlock+0x2c/0x50 [ 558.440732] ? d_alloc+0x290/0x380 [ 558.444273] ? __d_alloc+0xcc0/0xcc0 [ 558.448020] __lookup_hash+0x12e/0x190 [ 558.451937] do_unlinkat+0x3fe/0xa30 [ 558.455665] ? __ia32_sys_rmdir+0x40/0x40 [ 558.459808] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 558.465339] ? strncpy_from_user+0x3be/0x510 [ 558.469748] ? digsig_verify+0x1530/0x1530 [ 558.473979] ? kmem_cache_alloc+0x306/0x730 [ 558.478312] ? trace_hardirqs_on+0xbd/0x310 [ 558.482669] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 558.488215] ? getname_flags+0x26e/0x5a0 [ 558.492277] __x64_sys_unlink+0x42/0x50 [ 558.496264] do_syscall_64+0x1b9/0x820 [ 558.500156] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 558.505521] ? syscall_return_slowpath+0x5e0/0x5e0 [ 558.510444] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 558.515298] ? trace_hardirqs_on_caller+0x310/0x310 [ 558.520311] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 558.525327] ? prepare_exit_to_usermode+0x291/0x3b0 [ 558.530342] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 558.535201] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 558.540393] RIP: 0033:0x457579 [ 558.543583] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 558.562481] RSP: 002b:00007fc8058e0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 558.570185] RAX: ffffffffffffffda RBX: 00007fc8058e0c90 RCX: 0000000000457579 [ 558.577446] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 558.584707] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 558.591973] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058e16d4 14:03:36 executing program 5: pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000380)={0x0, @in6={{0xa, 0x4e23, 0xa6b, @local, 0x8001}}, 0x7, 0x3}, &(0x7f0000000440)=0x90) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000480)={r2, 0x7fffffff, 0x2}, 0x8) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000080)=0x0) syz_mount_image$nfs(&(0x7f00000004c0)='nfs\x00', &(0x7f0000000500)='./file0\x00', 0x9, 0x2, &(0x7f0000000680)=[{&(0x7f0000000540)="bf0cfe6bb24f767e2bea4c240b7ca06fee78bad2e62259a483c68df97fefb7286fdd96fc85cb5249011da069195b986d6fa3c5ee309692e2bbd725cb914e9d6b716e18ab9fd04979996f52c364eb22f73e7a9b6d2f57273037ccdeecffc7e35af1cbaf68a83b6c271bcdca4c624dee2faa4995e9ac12d6406ff37588889242ad1a153e96d2e1af85e8fb22d304309b63c0bbf2ef6f701f1a62001c546fec8b4741b61d684a7d74701c804ebd733dd1857b2a1ea9f423936559902fdc7cc5b2cd8a837a08b7d920e4d7a0a171d071698a8fbd1267594de5", 0xd7, 0x75e}, {&(0x7f0000000640)="a7a8ca", 0x3, 0xfe0}], 0x80005, &(0x7f00000006c0)='y\x00') getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000900)={r2, 0x1b48}, &(0x7f0000000940)=0x8) wait4(r3, &(0x7f0000000100), 0x1000002, &(0x7f0000000140)) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) clock_gettime(0x0, &(0x7f0000000840)={0x0, 0x0}) futex(&(0x7f0000000800)=0x2, 0x1, 0x2, &(0x7f0000000880)={r5, r6+10000000}, &(0x7f00000008c0), 0x2) setxattr$trusted_overlay_origin(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='trusted.overlay.origin\x00', &(0x7f0000000300)='y\x00', 0x2, 0x1) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000a00)={r4, 0xa15, 0x9}, 0x8) write$P9_RCREATE(r0, &(0x7f0000000200)={0x18, 0x73, 0x1, {{0x0, 0x4, 0x1}, 0x7fffffff}}, 0x18) r7 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000740)='/dev/vhci\x00', 0x40, 0x0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000980)=ANY=[@ANYBLOB="0e0000000500000003e83f00cbedc97ba226f14362007ee091633311259e22508ae7999559325b0bdabc72af76ceb6485715c70ebed299b400f797f666592a8b0a50916300000000000000"], 0x4b) bind$unix(r7, &(0x7f0000000780)=@file={0x0, './file0\x00'}, 0x6e) ioctl$KVM_X86_SETUP_MCE(r7, 0x4008ae9c, &(0x7f0000000240)={0xf, 0x1}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000a80)={r2, 0x7fff, 0x1f}, &(0x7f0000000ac0)=0x8) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r7, 0x84, 0x8, &(0x7f0000000700)=0x5, 0x4) write$P9_RCREATE(r7, &(0x7f0000000a40)={0x18, 0x73, 0x1, {{0x20, 0x1, 0x6}, 0x7}}, 0x18) ioctl$VT_WAITACTIVE(r0, 0x5607) [ 558.599259] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000004 14:03:36 executing program 3 (fault-call:5 fault-nth:6): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') [ 558.643967] __ntfs_error: 19 callbacks suppressed [ 558.643975] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:03:36 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x6000000) [ 558.728428] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 558.780549] FAULT_INJECTION: forcing a failure. [ 558.780549] name failslab, interval 1, probability 0, space 0, times 0 [ 558.816450] CPU: 0 PID: 377 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 558.823583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 558.832949] Call Trace: [ 558.832988] dump_stack+0x1c4/0x2b4 [ 558.833010] ? dump_stack_print_info.cold.2+0x52/0x52 [ 558.833034] ? __kernel_text_address+0xd/0x40 [ 558.844454] should_fail.cold.4+0xa/0x17 [ 558.844472] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 558.844489] ? save_stack+0xa9/0xd0 [ 558.862279] ? save_stack+0x43/0xd0 [ 558.865925] ? kasan_kmalloc+0xc7/0xe0 [ 558.869816] ? kmem_cache_alloc_trace+0x152/0x750 [ 558.874677] ? ovl_encode_real_fh+0xca/0x500 [ 558.879117] ? ovl_get_index_name+0x1c/0x80 [ 558.883444] ? ovl_lookup+0x9f2/0x29c0 [ 558.887345] ? __lookup_hash+0x12e/0x190 [ 558.891415] ? do_unlinkat+0x3fe/0xa30 [ 558.895314] ? __x64_sys_unlink+0x42/0x50 [ 558.899476] ? do_syscall_64+0x1b9/0x820 [ 558.903549] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 558.903575] ? up_read+0x1a/0x110 [ 558.912382] ? ext4_xattr_get+0x1ad/0xb30 [ 558.912422] ? d_alloc_parallel+0x1f40/0x1f40 [ 558.912467] ? fs_reclaim_acquire+0x20/0x20 [ 558.922728] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 558.925411] ? lock_downgrade+0x900/0x900 [ 558.925426] ? lock_downgrade+0x900/0x900 [ 558.925447] ? ___might_sleep+0x1ed/0x300 [ 558.945796] ? ___might_sleep+0x1ed/0x300 [ 558.949936] ? arch_local_save_flags+0x40/0x40 [ 558.954511] ? trace_hardirqs_on+0xbd/0x310 [ 558.958825] __should_failslab+0x124/0x180 [ 558.963052] should_failslab+0x9/0x14 [ 558.966841] __kmalloc+0x2d4/0x760 [ 558.970393] ? dput+0x15/0x20 [ 558.973522] ? ovl_encode_real_fh+0x1bb/0x500 [ 558.978030] ovl_encode_real_fh+0x1bb/0x500 [ 558.982349] ? ovl_set_attr+0x550/0x550 [ 558.986307] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 558.991828] ? ovl_lookup_single+0xd0/0x870 [ 558.996136] ovl_get_index_name+0x1c/0x80 [ 559.000270] ovl_lookup_index+0xe4/0x700 [ 559.004327] ? ovl_get_index_fh+0x2d0/0x2d0 [ 559.008666] ? ovl_path_real+0x400/0x400 [ 559.012714] ? kasan_slab_alloc+0x12/0x20 [ 559.016847] ? ovl_lookup+0x1178/0x29c0 [ 559.020805] ovl_lookup+0x9f2/0x29c0 [ 559.024522] ? ovl_path_next+0x2e0/0x2e0 [ 559.028598] ? do_raw_spin_unlock+0xa7/0x2f0 [ 559.032990] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 559.037556] ? kasan_check_write+0x14/0x20 [ 559.041776] ? do_raw_spin_lock+0xc1/0x200 [ 559.046003] ? _raw_spin_unlock+0x2c/0x50 [ 559.050152] ? d_alloc+0x290/0x380 [ 559.053685] ? __d_alloc+0xcc0/0xcc0 [ 559.057395] __lookup_hash+0x12e/0x190 [ 559.061272] do_unlinkat+0x3fe/0xa30 [ 559.064983] ? __ia32_sys_rmdir+0x40/0x40 [ 559.069118] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 559.074639] ? strncpy_from_user+0x3be/0x510 [ 559.079049] ? digsig_verify+0x1530/0x1530 [ 559.083268] ? kmem_cache_alloc+0x306/0x730 [ 559.087586] ? trace_hardirqs_on+0xbd/0x310 [ 559.091921] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 559.097445] ? getname_flags+0x26e/0x5a0 [ 559.101492] __x64_sys_unlink+0x42/0x50 [ 559.105457] do_syscall_64+0x1b9/0x820 [ 559.109329] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 559.114713] ? syscall_return_slowpath+0x5e0/0x5e0 [ 559.119664] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 559.124506] ? trace_hardirqs_on_caller+0x310/0x310 [ 559.129525] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 559.134525] ? prepare_exit_to_usermode+0x291/0x3b0 [ 559.139534] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 559.144361] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 559.149538] RIP: 0033:0x457579 [ 559.152718] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 559.171606] RSP: 002b:00007fc8058e0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 559.179297] RAX: ffffffffffffffda RBX: 00007fc8058e0c90 RCX: 0000000000457579 [ 559.186556] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 559.193914] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 559.201168] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058e16d4 [ 559.208432] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000004 14:03:37 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x4f7a0200) 14:03:37 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200000d0) 14:03:37 executing program 3 (fault-call:5 fault-nth:7): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:37 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x3, 0x208000) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x1fe, 0x3, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) socket$key(0xf, 0x3, 0x2) [ 559.241652] overlayfs: './file0' not a directory 14:03:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000045600637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:37 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20009d00) 14:03:37 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f0000000080)=0x1, 0x41, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x4, 0x600) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000100)) shmget(0x2, 0x3000, 0x5400000a, &(0x7f0000ffc000/0x3000)=nil) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) [ 559.337925] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 559.374744] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:03:37 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000169) [ 559.404230] FAULT_INJECTION: forcing a failure. [ 559.404230] name failslab, interval 1, probability 0, space 0, times 0 [ 559.442224] CPU: 0 PID: 422 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 559.449346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 559.458706] Call Trace: [ 559.461316] dump_stack+0x1c4/0x2b4 [ 559.464963] ? dump_stack_print_info.cold.2+0x52/0x52 [ 559.470156] ? __kernel_text_address+0xd/0x40 [ 559.474653] ? unwind_get_return_address+0x61/0xa0 [ 559.479608] should_fail.cold.4+0xa/0x17 [ 559.483668] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 559.488780] ? save_stack+0xa9/0xd0 [ 559.492407] ? __kasan_slab_free+0x102/0x150 [ 559.496814] ? kasan_slab_free+0xe/0x10 [ 559.500800] ? kfree+0xcf/0x230 [ 559.504074] ? ovl_encode_real_fh+0x3ba/0x500 [ 559.508576] ? ovl_get_index_name+0x1c/0x80 [ 559.512903] ? ovl_lookup_index+0xe4/0x700 [ 559.517142] ? ovl_lookup+0x9f2/0x29c0 [ 559.521027] ? do_unlinkat+0x3fe/0xa30 [ 559.524920] ? __x64_sys_unlink+0x42/0x50 [ 559.529071] ? do_syscall_64+0x1b9/0x820 [ 559.533131] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 559.538493] ? trace_hardirqs_off+0xb8/0x310 [ 559.542904] ? kasan_check_read+0x11/0x20 [ 559.547055] ? do_raw_spin_unlock+0xa7/0x2f0 [ 559.551463] ? trace_hardirqs_on+0x310/0x310 [ 559.555875] ? fs_reclaim_acquire+0x20/0x20 [ 559.560209] ? lock_downgrade+0x900/0x900 [ 559.564351] ? debug_check_no_obj_freed+0x305/0x58d [ 559.569367] ? ___might_sleep+0x1ed/0x300 [ 559.573515] ? arch_local_save_flags+0x40/0x40 [ 559.578096] ? ovl_encode_real_fh+0x3ba/0x500 [ 559.582594] __should_failslab+0x124/0x180 [ 559.586826] should_failslab+0x9/0x14 [ 559.590627] __kmalloc+0x2d4/0x760 [ 559.594168] ? ovl_encode_real_fh+0x3bf/0x500 [ 559.598677] ? ovl_get_index_name_fh+0x57/0x180 [ 559.603344] ovl_get_index_name_fh+0x57/0x180 [ 559.607841] ovl_get_index_name+0x5c/0x80 [ 559.611985] ovl_lookup_index+0xe4/0x700 [ 559.616048] ? ovl_get_index_fh+0x2d0/0x2d0 [ 559.620368] ? ovl_path_real+0x400/0x400 [ 559.624431] ? kasan_slab_alloc+0x12/0x20 [ 559.628579] ? ovl_lookup+0x1178/0x29c0 [ 559.632552] ovl_lookup+0x9f2/0x29c0 [ 559.636274] ? ovl_path_next+0x2e0/0x2e0 [ 559.640371] ? do_raw_spin_unlock+0xa7/0x2f0 [ 559.644777] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 559.649354] ? kasan_check_write+0x14/0x20 [ 559.653584] ? do_raw_spin_lock+0xc1/0x200 [ 559.657819] ? _raw_spin_unlock+0x2c/0x50 [ 559.661965] ? d_alloc+0x290/0x380 [ 559.665504] ? __d_alloc+0xcc0/0xcc0 [ 559.669223] __lookup_hash+0x12e/0x190 [ 559.673114] do_unlinkat+0x3fe/0xa30 [ 559.676852] ? __ia32_sys_rmdir+0x40/0x40 [ 559.681011] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 559.686561] ? strncpy_from_user+0x3be/0x510 [ 559.690971] ? digsig_verify+0x1530/0x1530 [ 559.695202] ? kmem_cache_alloc+0x306/0x730 [ 559.699521] ? trace_hardirqs_on+0xbd/0x310 [ 559.703841] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 559.709372] ? getname_flags+0x26e/0x5a0 [ 559.713431] __x64_sys_unlink+0x42/0x50 [ 559.717404] do_syscall_64+0x1b9/0x820 [ 559.721291] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 559.726670] ? syscall_return_slowpath+0x5e0/0x5e0 [ 559.731599] ? trace_hardirqs_on_caller+0x310/0x310 [ 559.736610] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 559.741635] ? recalc_sigpending_tsk+0x180/0x180 [ 559.746390] ? kasan_check_write+0x14/0x20 [ 559.750626] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 559.755470] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 559.760652] RIP: 0033:0x457579 [ 559.763843] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 559.782738] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 559.790446] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 [ 559.797709] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 14:03:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000139800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 559.804985] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 559.812248] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 [ 559.819510] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000006 14:03:37 executing program 5: mbind(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x3) get_mempolicy(&(0x7f0000000080), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x3c2, 0x210440) [ 559.854128] overlayfs: filesystem on './file0' not supported as upperdir 14:03:37 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) r0 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x4, 0x10000) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000100)=""/76) 14:03:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000001c8d00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:37 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x100000000000000) 14:03:37 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20000125) 14:03:37 executing program 3 (fault-call:5 fault-nth:8): mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) chdir(&(0x7f0000000280)='./file0\x00') unlink(&(0x7f0000000240)='./file0\x00') 14:03:37 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x100, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000100)={0x49, 0x29, 0x1, {0x7, [{{0x1, 0x2, 0x8}, 0x9, 0x1, 0x7, './file0'}, {{0x94, 0x0, 0x4}, 0x9, 0x800, 0x7, './file0'}]}}, 0x49) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) 14:03:37 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c0800000018f800637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) 14:03:37 executing program 5: get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) r0 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0xf9a5, 0x1) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0xc0240, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e20, 0x7fff, @empty, 0x10000}], 0x1c) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f00000000c0)={'syzkaller1\x00', {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x17}}}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) 14:03:38 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c08000000040c00637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 560.444013] ntfs: (device loop3): ntfs_fill_super(): Unable to determine device size. [ 560.460156] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. 14:03:38 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x200001e1) 14:03:38 executing program 4: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xc0109207, 0x20008c00) 14:03:38 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000100)={0x5c0000, {{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x16}}}, {{0x2, 0x4e22, @broadcast}}}, 0x108) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x1ff, &(0x7f0000ffe000/0x1000)=nil, 0x7) 14:03:38 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000100)=ANY=[@ANYBLOB="b702000008000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b7030000000000006a0a00fe000000008500000020000000b7000000000000009500000000000000"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe, 0xd7, &(0x7f0000000000)="3c080000000ba900637c380324dd", &(0x7f0000000480)=""/215, 0x8000}, 0x28) [ 560.491673] FAULT_INJECTION: forcing a failure. [ 560.491673] name failslab, interval 1, probability 0, space 0, times 0 [ 560.531172] CPU: 0 PID: 493 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 560.538323] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 560.547686] Call Trace: [ 560.547739] dump_stack+0x1c4/0x2b4 [ 560.547761] ? dump_stack_print_info.cold.2+0x52/0x52 [ 560.547787] ? mark_held_locks+0x130/0x130 [ 560.563392] should_fail.cold.4+0xa/0x17 [ 560.563415] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 560.572613] ? lock_release+0x970/0x970 [ 560.576625] ? ___might_sleep+0x1ed/0x300 [ 560.580791] ? arch_local_save_flags+0x40/0x40 [ 560.585393] ? do_syscall_64+0x1b9/0x820 [ 560.589468] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 560.594841] ? lock_downgrade+0x900/0x900 [ 560.598996] ? trace_hardirqs_on+0xbd/0x310 [ 560.603327] ? __might_sleep+0x95/0x190 [ 560.607313] ? __getblk_gfp+0xf4/0xd50 [ 560.611214] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 560.616673] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 560.622218] ? check_preemption_disabled+0x48/0x200 [ 560.627245] ? fs_reclaim_acquire+0x20/0x20 [ 560.631571] ? lock_downgrade+0x900/0x900 [ 560.635718] ? ___might_sleep+0x1ed/0x300 [ 560.639857] ? try_to_free_buffers+0xc80/0xc80 [ 560.644438] ? arch_local_save_flags+0x40/0x40 [ 560.649012] __should_failslab+0x124/0x180 [ 560.653234] should_failslab+0x9/0x14 [ 560.657022] kmem_cache_alloc+0x2be/0x730 [ 560.661156] ? __might_sleep+0x95/0x190 [ 560.665126] __d_alloc+0xc8/0xcc0 [ 560.668590] ? mark_held_locks+0x130/0x130 [ 560.672838] ? shrink_dcache_for_umount+0x2b0/0x2b0 [ 560.677857] ? __find_get_block+0xf20/0xf20 [ 560.682170] ? mark_held_locks+0x130/0x130 [ 560.686402] ? mark_held_locks+0x130/0x130 [ 560.690650] ? __wake_up_common+0x7d0/0x7d0 [ 560.694971] ? mark_held_locks+0x130/0x130 [ 560.699194] ? block_commit_write+0x30/0x30 [ 560.703530] d_alloc+0x96/0x380 [ 560.706798] ? __d_alloc+0xcc0/0xcc0 [ 560.710502] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 560.715507] ? bpf_prog_kallsyms_find+0xde/0x4a0 [ 560.720250] d_alloc_parallel+0x15a/0x1f40 [ 560.724469] ? mark_held_locks+0x130/0x130 [ 560.728691] ? __d_lookup_rcu+0xaa0/0xaa0 [ 560.732822] ? smk_access+0x53b/0x700 [ 560.736621] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 560.742416] ? __d_lookup+0x591/0x9e0 [ 560.746220] ? lock_downgrade+0x900/0x900 [ 560.750370] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 560.756151] ? smk_tskacc+0x3dd/0x520 [ 560.759971] ? unwind_get_return_address+0x61/0xa0 [ 560.764886] ? __lockdep_init_map+0x105/0x590 [ 560.769389] ? __lockdep_init_map+0x105/0x590 [ 560.773883] ? lockdep_init_map+0x9/0x10 [ 560.777945] ? __init_waitqueue_head+0x9e/0x150 [ 560.782598] ? init_wait_entry+0x1c0/0x1c0 [ 560.786822] __lookup_slow+0x1e6/0x540 [ 560.790706] ? vfs_unlink+0x510/0x510 [ 560.794516] ? down_read+0xb0/0x1d0 [ 560.798134] ? lookup_slow+0x49/0x80 [ 560.801846] ? __down_interruptible+0x700/0x700 [ 560.806512] ? d_lookup+0x221/0x340 [ 560.810136] ? inode_permission+0xb2/0x560 [ 560.814359] lookup_slow+0x57/0x80 [ 560.817886] lookup_one_len_unlocked+0xf1/0x100 [ 560.822559] ? lookup_slow+0x80/0x80 [ 560.826276] ovl_lookup_index+0x1c9/0x700 [ 560.830428] ? ovl_get_index_fh+0x2d0/0x2d0 [ 560.834750] ? ovl_path_real+0x400/0x400 [ 560.838797] ? kasan_slab_alloc+0x12/0x20 [ 560.842952] ? ovl_lookup+0x1178/0x29c0 [ 560.846934] ovl_lookup+0x9f2/0x29c0 [ 560.850637] ? ovl_path_next+0x2e0/0x2e0 [ 560.854701] ? do_raw_spin_unlock+0xa7/0x2f0 [ 560.859093] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 560.863659] ? kasan_check_write+0x14/0x20 [ 560.867880] ? do_raw_spin_lock+0xc1/0x200 [ 560.872117] ? _raw_spin_unlock+0x2c/0x50 [ 560.876259] ? d_alloc+0x290/0x380 [ 560.879797] ? __d_alloc+0xcc0/0xcc0 [ 560.883502] __lookup_hash+0x12e/0x190 [ 560.887384] do_unlinkat+0x3fe/0xa30 [ 560.891104] ? __ia32_sys_rmdir+0x40/0x40 [ 560.895237] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 560.900770] ? strncpy_from_user+0x3be/0x510 [ 560.905190] ? digsig_verify+0x1530/0x1530 [ 560.909420] ? kmem_cache_alloc+0x306/0x730 [ 560.913814] ? trace_hardirqs_on+0xbd/0x310 [ 560.918123] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 560.923642] ? getname_flags+0x26e/0x5a0 [ 560.927691] __x64_sys_unlink+0x42/0x50 [ 560.931655] do_syscall_64+0x1b9/0x820 [ 560.935528] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 560.940886] ? syscall_return_slowpath+0x5e0/0x5e0 [ 560.945816] ? trace_hardirqs_on_caller+0x310/0x310 [ 560.950836] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 560.955847] ? recalc_sigpending_tsk+0x180/0x180 [ 560.960598] ? kasan_check_write+0x14/0x20 [ 560.964818] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 560.969658] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 560.974847] RIP: 0033:0x457579 14:03:38 executing program 2: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) syz_mount_image$ntfs(&(0x7f0000000040)='ntfs\x00', &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f00000003c0), 0x0, &(0x7f0000000240)=ANY=[]) mount$overlay(0x400000, &(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=./file1,workdir=./file1']) r0 = creat(&(0x7f0000000080)='./file1/file0\x00', 0x0) r1 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") chdir(&(0x7f0000000280)='./file0\x00') setxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0/file0\x00', &(0x7f00000002c0)='trusted.overlay.redirect\x00', &(0x7f0000000300)='./file1\x00', 0x8, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f0000000140)={0x30}, 0x30) truncate(&(0x7f0000000200)='./file0\x00', 0x4000000000000) [ 560.978024] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 560.996922] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 561.004613] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 [ 561.011872] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 561.019143] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 561.026397] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 [ 561.033665] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000006 14:03:38 executing program 5: mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8001, &(0x7f00000000c0)=0x1, 0x41, 0x0) get_mempolicy(&(0x7f0000000140), &(0x7f0000000100), 0x1ff, &(0x7f0000ffc000/0x3000)=nil, 0x2) [ 561.093102] ntfs: (device loop2): ntfs_fill_super(): Unable to determine device size. [ 561.126874] ================================================================== [ 561.126878] BUG: KASAN: slab-out-of-bounds in string+0x298/0x2d0 [ 561.126882] Read of size 1 at addr ffff8801c4e286ba by task syz-executor3/493 [ 561.126884] [ 561.126887] CPU: 0 PID: 493 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #43 [ 561.126892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 561.126904] Call Trace: [ 561.126907] dump_stack+0x1c4/0x2b4 [ 561.126924] ? dump_stack_print_info.cold.2+0x52/0x52 [ 561.126926] ? printk+0xa7/0xcf [ 561.126929] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 561.126932] print_address_description.cold.8+0x9/0x1ff [ 561.126935] kasan_report.cold.9+0x242/0x309 [ 561.126937] ? string+0x298/0x2d0 [ 561.126940] __asan_report_load1_noabort+0x14/0x20 [ 561.126942] string+0x298/0x2d0 [ 561.126945] ? widen_string+0x2e0/0x2e0 [ 561.126947] vsnprintf+0x48e/0x1b60 [ 561.126949] ? pointer+0x990/0x990 [ 561.126952] ? lock_release+0x970/0x970 [ 561.126954] vscnprintf+0x2d/0x80 [ 561.126956] vprintk_store+0x43/0x510 [ 561.126959] ? do_raw_spin_lock+0xc1/0x200 [ 561.126962] vprintk_emit+0x1c1/0x930 [ 561.126964] ? wake_up_klogd+0x180/0x180 [ 561.126967] ? __lookup_slow+0x312/0x540 [ 561.126969] ? ___ratelimit+0x36f/0x655 [ 561.126972] ? lock_downgrade+0x900/0x900 [ 561.126974] ? trace_hardirqs_on+0xbd/0x310 [ 561.126977] ? kasan_check_read+0x11/0x20 [ 561.126979] ? ___ratelimit+0x36f/0x655 [ 561.126982] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 561.126985] vprintk_default+0x28/0x30 [ 561.126987] vprintk_func+0x7e/0x181 [ 561.126989] printk+0xa7/0xcf [ 561.126992] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 561.126995] ovl_lookup_index.cold.14+0xe8/0x1f8 [ 561.126997] ? ovl_get_index_fh+0x2d0/0x2d0 [ 561.127000] ? ovl_path_real+0x400/0x400 [ 561.127002] ? kasan_slab_alloc+0x12/0x20 [ 561.127005] ? ovl_lookup+0x1178/0x29c0 [ 561.127007] ovl_lookup+0x9f2/0x29c0 [ 561.127010] ? ovl_path_next+0x2e0/0x2e0 [ 561.127012] ? do_raw_spin_unlock+0xa7/0x2f0 [ 561.127015] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 561.127018] ? kasan_check_write+0x14/0x20 [ 561.127020] ? do_raw_spin_lock+0xc1/0x200 [ 561.127023] ? _raw_spin_unlock+0x2c/0x50 [ 561.127025] ? d_alloc+0x290/0x380 [ 561.127027] ? __d_alloc+0xcc0/0xcc0 [ 561.127030] __lookup_hash+0x12e/0x190 [ 561.127032] do_unlinkat+0x3fe/0xa30 [ 561.127034] ? __ia32_sys_rmdir+0x40/0x40 [ 561.127038] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 561.127040] ? strncpy_from_user+0x3be/0x510 [ 561.127043] ? digsig_verify+0x1530/0x1530 [ 561.127045] ? kmem_cache_alloc+0x306/0x730 [ 561.127048] ? trace_hardirqs_on+0xbd/0x310 [ 561.127051] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 561.127054] ? getname_flags+0x26e/0x5a0 [ 561.127056] __x64_sys_unlink+0x42/0x50 [ 561.127059] do_syscall_64+0x1b9/0x820 [ 561.127062] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 561.127064] ? syscall_return_slowpath+0x5e0/0x5e0 [ 561.127067] ? trace_hardirqs_on_caller+0x310/0x310 [ 561.127070] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 561.127073] ? recalc_sigpending_tsk+0x180/0x180 [ 561.127076] ? kasan_check_write+0x14/0x20 [ 561.127078] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 561.127081] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 561.127083] RIP: 0033:0x457579 [ 561.127092] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 561.127095] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 561.127102] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 [ 561.127106] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 561.127110] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 561.127113] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 [ 561.127117] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000006 [ 561.127119] [ 561.127121] Allocated by task 493: [ 561.127123] save_stack+0x43/0xd0 [ 561.127126] kasan_kmalloc+0xc7/0xe0 [ 561.127128] __kmalloc+0x14e/0x760 [ 561.127130] ovl_get_index_name_fh+0x57/0x180 [ 561.127133] ovl_get_index_name+0x5c/0x80 [ 561.127135] ovl_lookup_index+0xe4/0x700 [ 561.127137] ovl_lookup+0x9f2/0x29c0 [ 561.127139] __lookup_hash+0x12e/0x190 [ 561.127142] do_unlinkat+0x3fe/0xa30 [ 561.127144] __x64_sys_unlink+0x42/0x50 [ 561.127146] do_syscall_64+0x1b9/0x820 [ 561.127149] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 561.127151] [ 561.127153] Freed by task 3194: [ 561.127155] save_stack+0x43/0xd0 [ 561.127157] __kasan_slab_free+0x102/0x150 [ 561.127160] kasan_slab_free+0xe/0x10 [ 561.127162] kfree+0xcf/0x230 [ 561.127164] inotify_free_event+0x15/0x20 [ 561.127167] fsnotify_destroy_event.part.1+0x1ad/0x280 [ 561.127170] fsnotify_destroy_event+0x69/0x80 [ 561.127172] inotify_read+0x5c3/0x9d0 [ 561.127174] __vfs_read+0x117/0x9b0 [ 561.127176] vfs_read+0x17f/0x3c0 [ 561.127178] ksys_read+0x101/0x260 [ 561.127181] __x64_sys_read+0x73/0xb0 [ 561.127183] do_syscall_64+0x1b9/0x820 [ 561.127186] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 561.127187] [ 561.127191] The buggy address belongs to the object at ffff8801c4e28680 [ 561.127194] which belongs to the cache kmalloc-64 of size 64 [ 561.127197] The buggy address is located 58 bytes inside of [ 561.127201] 64-byte region [ffff8801c4e28680, ffff8801c4e286c0) [ 561.127204] The buggy address belongs to the page: [ 561.127208] page:ffffea0007138a00 count:1 mapcount:0 mapping:ffff8801da800340 index:0xffff8801c4e28f80 [ 561.127212] flags: 0x2fffc0000000100(slab) [ 561.127216] raw: 02fffc0000000100 ffffea00072f5988 ffffea00070def08 ffff8801da800340 [ 561.127220] raw: ffff8801c4e28f80 ffff8801c4e28000 0000000100000016 0000000000000000 [ 561.127224] page dumped because: kasan: bad access detected [ 561.127225] [ 561.127228] Memory state around the buggy address: [ 561.127232] ffff8801c4e28580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 561.127236] ffff8801c4e28600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 561.127240] >ffff8801c4e28680: 00 00 00 00 00 00 00 02 fc fc fc fc fc fc fc fc [ 561.127243] ^ [ 561.127246] ffff8801c4e28700: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 561.127250] ffff8801c4e28780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 561.127254] ================================================================== [ 561.127257] Kernel panic - not syncing: panic_on_warn set ... [ 561.127259] [ 561.127263] CPU: 0 PID: 493 Comm: syz-executor3 Tainted: G B 4.19.0-rc6+ #43 [ 561.127268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 561.127270] Call Trace: [ 561.127272] dump_stack+0x1c4/0x2b4 [ 561.127275] ? dump_stack_print_info.cold.2+0x52/0x52 [ 561.127278] ? lock_downgrade+0x900/0x900 [ 561.127280] panic+0x238/0x4e7 [ 561.127282] ? add_taint.cold.5+0x16/0x16 [ 561.127285] ? print_shadow_for_address+0xb6/0x116 [ 561.127288] ? trace_hardirqs_off+0xaf/0x310 [ 561.127290] kasan_end_report+0x47/0x4f [ 561.127293] kasan_report.cold.9+0x76/0x309 [ 561.127295] ? string+0x298/0x2d0 [ 561.127298] __asan_report_load1_noabort+0x14/0x20 [ 561.127300] string+0x298/0x2d0 [ 561.127303] ? widen_string+0x2e0/0x2e0 [ 561.127305] vsnprintf+0x48e/0x1b60 [ 561.127307] ? pointer+0x990/0x990 [ 561.127310] ? lock_release+0x970/0x970 [ 561.127312] vscnprintf+0x2d/0x80 [ 561.127314] vprintk_store+0x43/0x510 [ 561.127317] ? do_raw_spin_lock+0xc1/0x200 [ 561.127319] vprintk_emit+0x1c1/0x930 [ 561.127322] ? wake_up_klogd+0x180/0x180 [ 561.127324] ? __lookup_slow+0x312/0x540 [ 561.127327] ? ___ratelimit+0x36f/0x655 [ 561.127329] ? lock_downgrade+0x900/0x900 [ 561.127332] ? trace_hardirqs_on+0xbd/0x310 [ 561.127334] ? kasan_check_read+0x11/0x20 [ 561.127337] ? ___ratelimit+0x36f/0x655 [ 561.127340] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 561.127342] vprintk_default+0x28/0x30 [ 561.127344] vprintk_func+0x7e/0x181 [ 561.127347] printk+0xa7/0xcf [ 561.127349] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 561.127352] ovl_lookup_index.cold.14+0xe8/0x1f8 [ 561.127355] ? ovl_get_index_fh+0x2d0/0x2d0 [ 561.127357] ? ovl_path_real+0x400/0x400 [ 561.127360] ? kasan_slab_alloc+0x12/0x20 [ 561.127362] ? ovl_lookup+0x1178/0x29c0 [ 561.127365] ovl_lookup+0x9f2/0x29c0 [ 561.127367] ? ovl_path_next+0x2e0/0x2e0 [ 561.127370] ? do_raw_spin_unlock+0xa7/0x2f0 [ 561.127373] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 561.127375] ? kasan_check_write+0x14/0x20 [ 561.127378] ? do_raw_spin_lock+0xc1/0x200 [ 561.127380] ? _raw_spin_unlock+0x2c/0x50 [ 561.127383] ? d_alloc+0x290/0x380 [ 561.127385] ? __d_alloc+0xcc0/0xcc0 [ 561.127388] __lookup_hash+0x12e/0x190 [ 561.127390] do_unlinkat+0x3fe/0xa30 [ 561.127393] ? __ia32_sys_rmdir+0x40/0x40 [ 561.127396] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 561.127398] ? strncpy_from_user+0x3be/0x510 [ 561.127401] ? digsig_verify+0x1530/0x1530 [ 561.127404] ? kmem_cache_alloc+0x306/0x730 [ 561.127406] ? trace_hardirqs_on+0xbd/0x310 [ 561.127411] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 561.127414] ? getname_flags+0x26e/0x5a0 [ 561.127416] __x64_sys_unlink+0x42/0x50 [ 561.127419] do_syscall_64+0x1b9/0x820 [ 561.127422] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 561.127425] ? syscall_return_slowpath+0x5e0/0x5e0 [ 561.127427] ? trace_hardirqs_on_caller+0x310/0x310 [ 561.127430] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 561.127433] ? recalc_sigpending_tsk+0x180/0x180 [ 561.127436] ? kasan_check_write+0x14/0x20 [ 561.127438] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 561.127441] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 561.127444] RIP: 0033:0x457579 [ 561.127452] Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 561.127455] RSP: 002b:00007fc8058bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000057 [ 561.127462] RAX: ffffffffffffffda RBX: 00007fc8058bfc90 RCX: 0000000000457579 [ 561.127466] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000240 [ 561.127469] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 561.127473] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc8058c06d4 [ 561.127477] R13: 00000000004c26ba R14: 00000000004d8448 R15: 0000000000000006 [ 561.127479] Kernel Offset: disabled