e4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfba) 13:45:17 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:17 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000000), 0x0) dup2(r0, r1) mmap(&(0x7f0000200000/0x400000)=nil, 0x400002, 0x0, 0x2011, r1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 13:45:17 executing program 4: msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x2000) 13:45:17 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) [ 840.957911][T21630] FAT-fs (loop1): invalid media value (0x00) [ 840.963947][T21630] FAT-fs (loop1): Can't find a valid FAT filesystem 13:45:17 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf88, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0xe, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb922"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfba) 13:45:17 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000000), 0x0) dup2(r0, r1) mmap(&(0x7f0000200000/0x400000)=nil, 0x400002, 0x0, 0x2011, r1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) [ 841.197160][ T7] tipc: TX() has been purged, node left! 13:45:17 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000000), 0x0) dup2(r0, r1) mmap(&(0x7f0000200000/0x400000)=nil, 0x400002, 0x1, 0x10, r1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 13:45:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 842.044025][T21678] FAT-fs (loop1): invalid media value (0x00) [ 842.050122][T21678] FAT-fs (loop1): Can't find a valid FAT filesystem [ 843.788281][ T7] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 843.795879][ T7] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 843.831799][ T7] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 843.839749][ T7] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 843.879361][ T7] device bridge_slave_1 left promiscuous mode [ 843.885658][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 843.956727][ T7] device bridge_slave_0 left promiscuous mode [ 843.963049][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 844.019632][ T7] device veth1_macvtap left promiscuous mode [ 844.025685][ T7] device veth0_macvtap left promiscuous mode [ 844.056282][ T7] device veth1_vlan left promiscuous mode [ 844.062066][ T7] device veth0_vlan left promiscuous mode [ 847.982891][ T7] bond1 (unregistering): Released all slaves [ 848.169428][ T7] device hsr_slave_0 left promiscuous mode [ 848.198116][ T7] device hsr_slave_1 left promiscuous mode [ 848.289012][ T7] team0 (unregistering): Port device team_slave_1 removed [ 848.326608][ T7] team0 (unregistering): Port device team_slave_0 removed [ 848.357064][ T7] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 848.406211][ T7] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 848.503696][ T7] bond0 (unregistering): Released all slaves [ 848.606051][T21687] IPVS: ftp: loaded support on port[0] = 21 [ 848.790699][T21687] chnl_net:caif_netlink_parms(): no params data found [ 848.857734][T21687] bridge0: port 1(bridge_slave_0) entered blocking state [ 848.864850][T21687] bridge0: port 1(bridge_slave_0) entered disabled state [ 848.875116][T21687] device bridge_slave_0 entered promiscuous mode [ 848.888386][T21687] bridge0: port 2(bridge_slave_1) entered blocking state [ 848.895634][T21687] bridge0: port 2(bridge_slave_1) entered disabled state [ 848.904957][T21687] device bridge_slave_1 entered promiscuous mode [ 848.932270][T21687] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 848.945680][T21687] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 848.973089][T21687] team0: Port device team_slave_0 added [ 848.983918][T21687] team0: Port device team_slave_1 added [ 849.006048][T21687] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 849.013959][T21687] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 849.043419][T21687] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 849.060063][T21687] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 849.070346][T21687] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 849.096883][T21687] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 849.158621][T21687] device hsr_slave_0 entered promiscuous mode [ 849.196684][T21687] device hsr_slave_1 entered promiscuous mode [ 849.312262][T21687] bridge0: port 2(bridge_slave_1) entered blocking state [ 849.319345][T21687] bridge0: port 2(bridge_slave_1) entered forwarding state [ 849.326651][T21687] bridge0: port 1(bridge_slave_0) entered blocking state [ 849.333714][T21687] bridge0: port 1(bridge_slave_0) entered forwarding state [ 849.388841][T21687] 8021q: adding VLAN 0 to HW filter on device bond0 [ 849.405633][ T7926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 849.416258][ T7926] bridge0: port 1(bridge_slave_0) entered disabled state [ 849.424129][ T7926] bridge0: port 2(bridge_slave_1) entered disabled state [ 849.437764][T21687] 8021q: adding VLAN 0 to HW filter on device team0 [ 849.451284][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 849.460848][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 849.467936][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 849.486569][T26783] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 849.494899][T26783] bridge0: port 2(bridge_slave_1) entered blocking state [ 849.501963][T26783] bridge0: port 2(bridge_slave_1) entered forwarding state [ 849.519920][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 849.529305][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 849.548489][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 849.557787][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 849.566448][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 849.577487][T21687] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 849.595910][T26783] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 849.604504][T26783] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 849.617666][T21687] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 849.676854][ T7926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 849.685828][ T7926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 849.705031][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 849.713737][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 849.722909][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 849.735272][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 849.745142][T21687] device veth0_vlan entered promiscuous mode [ 849.758976][T21687] device veth1_vlan entered promiscuous mode [ 849.783122][ T7926] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 849.791530][ T7926] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 849.800042][ T7926] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 849.809530][ T7926] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 849.821883][T21687] device veth0_macvtap entered promiscuous mode [ 849.832711][T21687] device veth1_macvtap entered promiscuous mode [ 849.851739][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 849.863551][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 849.873620][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 849.884235][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 849.894134][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 849.904702][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 849.914634][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 849.925139][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 849.936517][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 849.947285][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 849.958518][T21687] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 849.967007][T26783] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 849.975299][T26783] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 849.984075][T26783] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 849.993041][T26783] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 850.004465][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 850.015572][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 850.026905][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 850.037420][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 850.047275][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 850.059066][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 850.068952][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 850.080016][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 850.090520][T21687] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 850.101044][T21687] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 850.112134][T21687] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 850.120146][ T7809] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 850.130238][ T7809] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 13:45:27 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:27 executing program 4: msgsnd(0x0, 0x0, 0x0, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x2000) 13:45:27 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000000), 0x0) dup2(r0, r1) mmap(&(0x7f0000200000/0x400000)=nil, 0x400002, 0x1, 0x10, r1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 13:45:27 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) 13:45:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf90, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0xf, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f71"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc2) 13:45:27 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:27 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000000), 0x0) dup2(r0, r1) mmap(&(0x7f0000200000/0x400000)=nil, 0x400002, 0x1, 0x10, r1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) [ 851.318632][T21742] FAT-fs (loop1): invalid media value (0x00) [ 851.324689][T21742] FAT-fs (loop1): Can't find a valid FAT filesystem 13:45:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf90, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0xf, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f71"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc2) 13:45:27 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000000), 0x0) dup2(r0, r1) mmap(&(0x7f0000200000/0x400000)=nil, 0x400002, 0x1, 0x2011, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 13:45:28 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000000), 0x0) dup2(r0, r1) mmap(&(0x7f0000200000/0x400000)=nil, 0x400002, 0x1, 0x2011, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 13:45:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf90, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0xf, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f71"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc2) 13:45:28 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xb8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000000), 0x0) dup2(r0, r1) mmap(&(0x7f0000200000/0x400000)=nil, 0x400002, 0x1, 0x2011, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 13:45:28 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:28 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[], 0x0, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x2000) 13:45:28 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:28 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf94, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee4952"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc6) 13:45:28 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 852.444449][T21791] FAT-fs (loop1): invalid media value (0x00) [ 852.450631][T21791] FAT-fs (loop1): Can't find a valid FAT filesystem 13:45:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf94, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee4952"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc6) 13:45:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf94, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee4952"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc6) 13:45:29 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[], 0x0, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x2000) 13:45:29 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:29 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf96, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee49524a53"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc8) 13:45:29 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:29 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 853.448620][T21817] FAT-fs (loop1): invalid media value (0x00) [ 853.454685][T21817] FAT-fs (loop1): Can't find a valid FAT filesystem 13:45:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf96, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee49524a53"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc8) 13:45:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf96, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee49524a53"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc8) 13:45:30 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[], 0x0, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x2000) 13:45:30 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(0x0, 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:30 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf97, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee49524a537a"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc9) 13:45:30 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) 13:45:30 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf97, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee49524a537a"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc9) 13:45:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000180)={@void, @val={0x0, 0x0, 0x2}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "9eef7b", 0xf97, 0x2b, 0x0, @empty, @mcast2, {[@srh={0x0, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@mcast1]}], @ndisc_na={0x88, 0x0, 0x0, 0x0, [], @mcast2, [{0x0, 0x10, "f4504611fddb4f56c81a22ffa3ce68b8e4a8343d11f75b45f78bb3d057db0f0e4b882feb2e4a623dbadf639d2d83a5635dae36eab0f99c3ede38a3e829345d4377e15ca5ed79cab59a7597f8fc14b4e84f07446d773c2155efea0f7a1bd5e1baa4ad46ed73af614b24a6097d7646788a9fb9228445149f24b92f7116ee49524a537a"}, {0x0, 0x13, "761c3552ee1fde5a0a2d384bdf545a59a1880fadc5cb5643d839c595dad95bce52f596e945f7c99e3efe71c829ceead5474f584970af4a8fc0e4e5d2fac4993ec549a4d711331fa04369914ebdb190e9f73cf54677639d3180d91f16e07bfa1adfbd5637ac708fffd30461d8c156757c67c0c15d21c1b8046121af71dee596bbdf9c9af164e19c9639f0a22cde46ab53e4c5933d532b8457d1df"}, {0x0, 0x12, "fa2953a38efaa66f5942dd4d701b0a53804dd8c587749f831cafa728e6274ebc81eb4d6fedb40be16b5f4a2c38110500000000000000470a8918d06d164314f9006d9557020063f42c7e9f5ee8c7524d0e767cce7993d59d4a90a71c3bb407ed6ad0efa01608731cb9229ed82c5d7710da67dd86e50d355a1ea695fa6a4ea34035e25c74f84fea7476000000000000"}, {0x0, 0x1b6, "3ce1279f0fb73876785500e4739be9601142c65c84b90f4b001b86db1e65a6af2e0a8a8008449d56e68f20fc254760894eb4ccea94cb488d658226e1db7b0c3a4c523666fb0f5f28cba1c9ffe8abe8225f6f361b6a2e23940886566c25b30c9e9a4344f2bd3c5e16f5c0dee35d54309a9bbd239cc6e66a66cc4acc7aa118dfa8bdbf3c3e6a0e5b154b9ff939debe8d37b60a7fdd9571a95c277c5c257c8ed900359345c6fb34d8ef3ec72ac8c85c3ba1b4d1c47166b59deb2317adeac0258131b1aba4ffeebe648af34390da12197b071d7bffd2a7d416b2cb7d87f071d2d52a9fe666e5a3896610b789315fbf2e1b48868af53cbf408aba7c478c55f6458ff4adbeac29d5ff98090af9bb985e23b33d7853cf71f15a0ab22c86df5b6a0e35607c4795b57b62131a783866662f78be47383db8504b5f877690ab25fbd58016b37fe49e12e25d6a878cd74a50b0c551538aa59ba715459e200db174c3c382eaad6b0346474e89ce67fd9ad5141eb69d04da8f8abb555b6ddeef14d6be5e586f1058f2f4cf0d56e63e6a2e228dd1179546687f1c5d002212bc37fa10d81f757a6dd351fbe3be3208e34ccaa93b6c27e2bdc6c8d199f1808ba9cfe8992a0c3ef635ca1074536b0d24f62d01651d06cb78017f8a712b748e4280399a6b770261d6fcf26aebed86b2b6811115a9bf0257e469cc97c0aa221ab5c1152379e3d8eb94f02988f748a2d52f1cb61be19b8e2234b6391ca6741d49939d6b29070730b1bcf0eaeb6f96352c9d4612159d6010c2c8e14ca32efb971e1623cb4d3636cb84d52fd49ad73e928defcf229f1b3e355995e28f36411f66232457e96141130b3145dffd10954949bdcb8e34b144aa5e4ebc17750d95e85fade2fbf03260ca015ed4cf828476f379c466cb0f650f9200f3b2546e1011fb06bfe1bdc524dc889b55e44bc0900ffe09dd51e2989ee5186d604add5e00f9f9840798d9dc0a6c6612e2c61169a337cfef79c67c010aba8fd550968069aecbf77e3cd992f2eead3b39d573f041f97b0636e57336c1bbc9db39d0a38d2033d44a368f988d077248805e2f0eddfe6e3b264edb5819fd125e7417b0dbd3b75450c0a4dd76e4ed7b8c48502b0e58cee70667999e7a45490f29f6c6943baf337ac581b0b033bac212e844342675935fd394a0cd6d48b5093232dac032958db905fa976daed6755917dbda7ebf14112a1b8c3865f518d215958b1612a33b4fd9b9a9f36dfdfa43e1042236046800e89e556900f7940d5e4385e7dc2c14784d07e9eba66b380c9e08c7b55bf2886a42ff930be67c1c7260a16336bee506dd70220be1c0c45b31db873346fb5d0b80578fd3c4bd7b6eb504dd2251bbefe149c4ac3eb756858c7da00c8bc610ea432e86953f6d2a4fed4d3184e6beba911f13dd1e64874d1dcc2cdbb5de19cafd4c8cdb87300bf3bfb0fd6bde025607b267125ba8a7a9a84d31991fe1ceab4ff4a35aabbc517e5cfe9a1341f561cef85574223b5933050c3212a0fad0ba3a9e84091575499ef1c7e386ad2525aeff6ef7eaa787a9099396f8b1d6144d82150ac65422be15b04e9d6c9dca8c913bb369fdb3764d2dd08fa981f89383fc1c9dbcc7ce93253a4850df1f0a440d597f6433f9cd4a4d8ccc50001e0eb8d8ab7abcb36102434ce7de287e335b072f3d2405ebb4876af97940b27109a0735cc2e37642f02be6db81b8552a7d90e9658dcbdea4491a22f66524bc236a5d6aa5363eed5319c4b0cc492232301aec578c061b1ec6049d979c96a63a73e931aa1256616f5910756bd46e2e62912b6faec57a9af6862a472aebdb81298ffb5889d9764b6968e979797cffdf77992113ae9a2a9c5d81a08b24c3598749fc99d82d052fa29d08cec8656335d53a3bf2a54862b59995746e279735a81ee927577b13b4986d2e5e9e06c8a5f5e42fe27150cbd327abf72cbba128da136570f27be281b8071e8403950b0b443434382947fb3edc9225126451037ec7a000ca019053c5061f41c399596e61aa21206d1e6e67c3c10bdd547ce5f68ffc52e275952c09d1614619fe84aac998941505791767227389f14efa89e52c7abf942bacc22878d4ca6ab002e30d4902c04bce25b3b878bcad2b1d1a1a679211b8b534c89d69278a6053bb77104f6fe0972fa28db6905c924c758d1f5560ede68edf4fee27ec5c4a35f9c0955492ab9fb9bea03ea5feb05c67fcc807584a333d25bbb735fd259eb4ba26f0ac48c5ce12ba03c6b299eae60ab1eced5d2e27e1a683c8bd2258081e81fd40cf6492c0fa031e66b411a80000e7f2b7ee74e0c5b162704d9f8d7c130b70ada2d2fbeccf164de42b91c26f8d8e23771ad617d978b74764773a406a3be8f60e96ccc4966d6679c76692c7ad883d79eab41fb0bb8300f60ab3b4b665d0447c114320e81bd108b5a4ada07fe132f696629cf983fc372016c665a4aefa0ffaa56fa58f0ac2587951b508e50acccc6c862e49cee3fbb058978e8d9ccf43c170516728e7d07b1caadff996ddb3fbf97056c88458a62c98b96959d8e214975704b85530eccf108046c86846347a6cb7d5c2d801d765de6eb4a204de7ac4a902685692a5ea1b201dfb008747ede850e97d2bbad644b7b1e55d6ba9613d3a9bca95f961125b476da492b614b22a4e4ec7b6e3fb9837568edaeae6dea090440d00612e5d3d20565e593e2e6150c438ae90c1a69a49ff549b77f4d9a66c758e5c48ba945319b7dee5a2dd1b7d3ab2753310844aaca72c4132be049c21e64fba1f299bf11158e37d4fc14ca5ecefe29628b69b18a3bc3b4ca4bdf9e2c80a1e93fbc4b4af9e8120fd190742644bfa9dcef6f64ed73795b7f35cc6d641f2b5d2e69a1f9272a5700d683c6a1102b8affabb3dab85325c457c63b572aba731db0c73df05cad19de183dc51f5304e7e5e51f97cb9ca8daaa42a75b53cfb065d93f2f7a2e48ca02c8803ba73287175eed3032e7c21be1682b0c00482b32fb3b6bb0f8b517873de7e764d550620c5f59b4beef4caf85de16eee32b0a85b8a219564a1523baa12ebdcbb2d8ce83a7aa4a47fde3542be5dc92b254479a1929763e91986c15e4d457ccc8bf6471a6a89aedc6c1e0e7842526b814177e506c74861e43a5c0a7e5292828b7b0cbe012dc12303d6f8f89273108ea8ffcdc3420024bdf28b7c5eaa332648bb76b7271cba0add0e5acd8e2089e82bc97498fa75d14fa7dc853b080adeec5c6e04594e60c23f9ea7847d806ed8997d27c520c9ec3c601cb56d665f8b822796767c2e9834be285055d25beea5d69b2c6e97658014720cf6b4230c4b09775e39323aafedcd2e8eb00e439ebec40e6abaeafb6cfe6bcbc000038ba247f0ed73263e6a803c212d92284a936f0b84c1cf3b62d71d79edc0891ecd7d60854ccfb1b3125abe4231ee24f268cadf0d09106debedb4210cfa9ddc7e821f438838ab15ef6e154165969c921eaad701d6aadb78ff521143a72d77d6320f1aa6bad90d3bb37edc88e58a997d5d140e89aad234368d1ac3d19a99ec13a0c3931b05f9f4a26eccc9562c1d812e850db6c42aef6bd9c192baca539f1194b04a83e829d6da1e3c4580537d9c53eccce18efb6e198e2998049a458b0d655f6184f73f9ca90ac9aad50b426f8a38e24c0b97048e15279bcb53b1c9d2552ea0f15a736556b35a8539ae8f947e8857d758f151f10241574e96cfea2d0bb3a36f8165e12a39de5681102af863a8687cce78affd46dff2751fd06bbbce36aeccd5c40456074e104e936c1de6b46f6f1e0f087d1f77dc3f175c5c573cd0737f2cf582865ac181f295b19a74f06f94356c13cb52864dbfaaf7c1979f2e1ac319c54f48daba62524e1eb9f676a06649c8f26d717efd0f71b23643a6a2b08d304014ba13c2b560c455e5201349484fbad51390b81fa2c95ec456bdcd941042f7beb4e4189e9378227734e8a64c8901e5bd28bf701d6892616c29469f7dbc655944e5b5d1063e9979c0ab10b413105847b9ce8862377cefd110b99972aaa3ce8470aef5d5d887f6aec23c7056410bd8e68c5f0caf4b270186e09b854eae46890a4fd7ffb4dd2c5afbe12eb3bc9a28388ecdf2411705e361991177d3a9d54ac150e5c99883e6155dd1621a0c964c995303f4d71c2a975f45ac24ac7b01048366c8e17b15c32b896b81539d518f9606299da10edc03c5241985905c4f9b96e0efda5ff56c1656f4cd3dad1d1e0001206a3bf1abee9adc49c6e7141d5a1cce931a540a52113befdf835c4063ea010560f3be1f640722dea1c26ad5c3d00dc76a554a58b29213d8622a0209d9452ce3d576d99450d38fefa06a22feef343ab78f312e5d945bcf8bc4236b6fa7dcc47c06a1eff2c243c9df90e96caef7382b78e5abf233cc6f4cf65381e8c5b228653b01cfec059e34038c9cb2e61a9cfe02100c5e77f7210f56333450d861fed7cbce01c3265e3ca3e043d99b738a0ac6b856dfb345f42d53c50e457f0aa3db22a9b417ba4b88c816a41beaa473f9fde65f47166ca83195c8779efdb6f807aae529919802ef1fb9d306151c8cadd8a233207ac411dc41118f42e4ef5df8dc126d7a93fa8958562d6e1c139cd4c0b3cded8abbcf571908c670f2f1e397d635a88a780382038972195a8e5a67bbc2739dbf413ed5d372eb14e68d7da023b400865e44fd36fe8ab66b7de49a2622d4f9cb71e55afd988f9fe498ad4a52f2b940b7e6abda1ed9f921ca05dacc9b35d6a25e527f750a37e204add5067e40543f51ce0a8273c7a08006c4858eeec0b1453f8380bc767ef98da1eab7d39704bf2a1a02424a8b12f11ca0b7922dbfc595bc01a79e5588345a080c130daa1fdc535c1f9bbfdac8af266d147c908a41fe168fc43c4dcd4c839c2bfa7e9dee2c129866af6953276a1ffcf9073d45149fa08396948cf8936f1ba351c61f6db1336f186ddb"}]}}}}}, 0xfc9) 13:45:31 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x2000) 13:45:31 executing program 5: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:31 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) sendfile(0xffffffffffffffff, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:31 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(0x0, 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:31 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:45:31 executing program 2: syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x40000000909, 0x1) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0) socket(0x1a, 0x80000, 0x20) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000001c0)=""/252, 0x63}], 0x2, 0x0) 13:45:32 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x2000) 13:45:32 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ubi_ctrl\x00', 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000000380)=[{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x18, 0x1, 0x1, [r0, r0]}}], 0x18}], 0x1, 0x0) 13:45:32 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ubi_ctrl\x00', 0x0, 0x0) sendmmsg$unix(r1, &(0x7f0000000380)=[{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f0000000340)=[@rights={{0x18, 0x1, 0x1, [r0, r0]}}], 0x18}], 0x1, 0x0) 13:45:32 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) sendfile(0xffffffffffffffff, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:32 executing program 5: 13:45:32 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(0x0, 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:32 executing program 5: 13:45:32 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 13:45:32 executing program 5: 13:45:32 executing program 2: 13:45:32 executing program 2: 13:45:32 executing program 2: 13:45:33 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x2000) 13:45:33 executing program 5: 13:45:33 executing program 2: 13:45:33 executing program 5: 13:45:33 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) sendfile(0xffffffffffffffff, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:33 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:33 executing program 2: 13:45:33 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 13:45:33 executing program 5: 13:45:33 executing program 2: 13:45:33 executing program 5: 13:45:34 executing program 2: [ 857.704150][T21961] overlayfs: failed to resolve './file0': -2 13:45:34 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x2000) 13:45:34 executing program 5: 13:45:34 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) dup(r1) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:34 executing program 2: [ 858.143154][T21953] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 858.152218][T21953] FAT-fs (loop1): Filesystem has been set read-only [ 858.159823][T21953] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:34 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x2000) 13:45:34 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:34 executing program 2: 13:45:34 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) 13:45:34 executing program 5: 13:45:34 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, 0x0, 0x0, 0x3, 0x2000) 13:45:34 executing program 2: 13:45:34 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x0, 0x2000) 13:45:35 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x0, 0x2000) 13:45:35 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x0, 0x2000) 13:45:35 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x0) 13:45:35 executing program 5: 13:45:35 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) dup(r1) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 859.199431][T21993] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 859.208415][T21993] FAT-fs (loop1): Filesystem has been set read-only [ 859.215894][T21993] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:35 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:35 executing program 2: 13:45:36 executing program 5: 13:45:36 executing program 2: 13:45:36 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) sendfile(0xffffffffffffffff, r0, 0x0, 0xa198) 13:45:36 executing program 2: 13:45:36 executing program 5: r0 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @remote}, 0x1c) [ 860.106455][T22026] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 860.121418][T22026] FAT-fs (loop1): Filesystem has been set read-only [ 860.129328][T22026] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:36 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x0) 13:45:36 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) dup(r1) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:36 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r2, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000011039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c65400"}, 0x80) getsockname$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) sendmmsg(r2, &(0x7f0000000800)=[{{&(0x7f0000000240)=@ll={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x80, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) 13:45:36 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$tun(r0, &(0x7f0000000140)={@void, @val={0x3}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x26}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}, 0x32) 13:45:36 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x0) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 860.383708][T22052] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 860.421591][T22052] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 860.476580][T22052] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 860.567783][T22055] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 860.781025][T22055] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 860.850358][T22055] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 13:45:37 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:37 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$tun(r0, &(0x7f0000000140)={@void, @val={0x3}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x26}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}, 0x32) 13:45:37 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) sendfile(0xffffffffffffffff, r0, 0x0, 0xa198) 13:45:37 executing program 4: msgsnd(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="90"], 0x1, 0x0) msgrcv(0x0, &(0x7f0000000300)={0x0, ""/210}, 0xda, 0x3, 0x0) [ 861.137449][T22062] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 861.146388][T22062] FAT-fs (loop1): Filesystem has been set read-only [ 861.153827][T22062] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 861.320421][T22075] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 13:45:37 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x9000018d) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r1, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:37 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x0) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 861.557185][T22075] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 861.687485][T22075] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 861.785960][T22071] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 861.796891][T22071] FAT-fs (loop5): Filesystem has been set read-only [ 861.804612][T22071] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:45:38 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:38 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:39 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write$tun(r0, &(0x7f0000000140)={@void, @val={0x3}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x26}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}, 0x32) [ 862.710996][T22097] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 862.719875][T22097] FAT-fs (loop1): Filesystem has been set read-only [ 862.727415][T22097] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:39 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x0) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:39 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f00000001c0)='\xb3', 0x0) write$FUSE_DIRENT(r1, &(0x7f0000000080)=ANY=[], 0x560) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x81, 0x11, r1, 0x0) ioctl$TCSETS(r0, 0x5423, &(0x7f0000000080)) 13:45:39 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:39 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) sendfile(0xffffffffffffffff, r0, 0x0, 0xa198) 13:45:39 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x9000018d) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r1, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:39 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) sendfile(r3, r4, 0x0, 0x200fff) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 863.186849][T22120] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 863.222132][T22120] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 863.311072][T22120] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 863.333403][ T26] audit: type=1804 audit(1582811139.630:244): pid=22242 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1361/bus" dev="sda1" ino=16597 res=1 [ 863.680157][ T26] audit: type=1804 audit(1582811139.770:245): pid=22242 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1361/bus" dev="sda1" ino=16597 res=1 13:45:40 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file1\x00', 0x143042, 0x0) ftruncate(r1, 0x200004) r2 = open(&(0x7f0000000100)='./file1\x00', 0x143042, 0x0) ftruncate(r2, 0x0) 13:45:40 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:40 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) dup(r1) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) 13:45:40 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x9000018d) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r1, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 864.038086][T22237] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 864.047025][T22237] FAT-fs (loop1): Filesystem has been set read-only [ 864.053715][T22237] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:40 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 864.172363][ T26] audit: type=1800 audit(1582811140.470:246): pid=22242 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16597 res=0 [ 864.209354][ T26] audit: type=1804 audit(1582811140.510:247): pid=22242 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1361/bus" dev="sda1" ino=16597 res=1 13:45:40 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000080)) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000040)) [ 864.452962][ T26] audit: type=1804 audit(1582811140.540:248): pid=22248 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1361/bus" dev="sda1" ino=16597 res=1 13:45:41 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) sendfile(r3, r4, 0x0, 0x200fff) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 864.878993][ T26] audit: type=1804 audit(1582811141.180:249): pid=22381 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1362/bus" dev="sda1" ino=16597 res=1 [ 864.895538][T22364] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 864.913125][T22364] FAT-fs (loop5): Filesystem has been set read-only [ 864.923140][T22364] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 864.937956][ T26] audit: type=1804 audit(1582811141.220:250): pid=22381 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1362/bus" dev="sda1" ino=16597 res=1 13:45:41 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r5, r4, 0x0, 0xa198) 13:45:41 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) dup(r1) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) 13:45:41 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:41 executing program 4: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) sendfile(r3, r4, 0x0, 0x200fff) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:41 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 865.323301][ T26] audit: type=1804 audit(1582811141.620:251): pid=22495 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir181471161/syzkaller.cKNGxH/1181/bus" dev="sda1" ino=16568 res=1 [ 865.403839][ T26] audit: type=1804 audit(1582811141.640:252): pid=22495 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.4" name="/root/syzkaller-testdir181471161/syzkaller.cKNGxH/1181/bus" dev="sda1" ino=16568 res=1 [ 865.539681][ T26] audit: type=1800 audit(1582811141.840:253): pid=22495 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.4" name="bus" dev="sda1" ino=16568 res=0 13:45:41 executing program 4: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) sendfile(r3, r4, 0x0, 0x200fff) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:42 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) sendfile(r3, r4, 0x0, 0x200fff) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:42 executing program 4: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) sendfile(r3, r4, 0x0, 0x200fff) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:42 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) dup(r1) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) 13:45:42 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:42 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r5, r4, 0x0, 0xa198) 13:45:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f0000000140)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x8812, 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000100)='./file1\x00', 0x143042, 0x0) ftruncate(r1, 0x200004) 13:45:42 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:43 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) sendfile(r3, r4, 0x0, 0x200fff) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:43 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:43 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x9000018d) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r1, r0, 0x0, 0xa198) 13:45:43 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r5, r4, 0x0, 0xa198) 13:45:43 executing program 4: unshare(0x44000600) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7704, 0x0) 13:45:43 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 867.853910][T22983] IPVS: ftp: loaded support on port[0] = 21 13:45:44 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x11, 0x800000003, 0x0) bind(r4, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000340)=0x14) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[@ANYBLOB="ec0100002800270d00"/20, @ANYRES32=r5, @ANYBLOB="0480000000800000f2ff00000800010075333200c0010200bc01010004000200b40105510004d72000000807000000ff03fffffffffffff00100000001010000000000010000000000000001ffb810000000000080000080000000000407000000080000d000000040000000050400000020000000000000620000000007000000400000000000800100000000089f1abf5f01978b467790f81f8178070000009b55b91601000300000000000009ffff800009002f3de672922ca7287d55e227a85e000029000000085408b300fbffffff000000080001000007000000f8f600000000a243000080010400000000000000000000675b0d41d9af33380b545184138e54a0000000080800000000000000000001ff00a91dee3840b23390408565200eb7070020007f000000800000000000007f01000000ff7f00000000000580000001010017fbbc930000fa000010000c00000004070000000000200000000809000008090020000000000700020fffc359000002000000000004000000000900000000000a0000000000060000081707000000ff03000000000007000001ff1200000002000000000000020002000401019910ec13000000e5000300000006000100000900000000000020000013037f000000ff7f00000000001022bd9d000000000000adf007117909895d0ffdc701d59f03d529d940ca2c02eaaa04a8e080b422265e02ae1817f396d57182598287b386ff8cdad692ef98b45b5f7d302a9c27a7e7e5501a583f3a35e2833cd7ed3c5ecae0148ee8e7b69342c9a20caee6d01df95a395d92aca5a9620062d353429dd782684ed3e695921980b1f20e4ad251e1e08156283a14deb206ed12cc3f684847d788b083d3321d7cbfa07b5e1b8e3fb37ec8c429e2cbbfec27a9660c7026588442f5f9f4557511ec050d7a43ed56192fdb1f50cf3f8d9f1b62f596024f8c496cb2f4ea1ff3cefe5bb7b229ec4b81b626f53eed9ffe419ccf45f6bd19857c8c40"], 0x1ec}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) 13:45:44 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:44 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(0xffffffffffffffff, r4, 0x0, 0xa198) 13:45:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x9000018d) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r1, r0, 0x0, 0xa198) 13:45:44 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(0xffffffffffffffff) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 868.276179][ T4619] tipc: TX() has been purged, node left! [ 868.374458][T22979] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 868.383631][T22979] FAT-fs (loop1): Filesystem has been set read-only [ 868.391276][T22979] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:44 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x11, 0x800000003, 0x0) bind(r4, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000340)=0x14) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[@ANYBLOB="ec0100002800270d00"/20, @ANYRES32=r5, @ANYBLOB="0080000000800000f2ff00000800010075333200c0010200bc01010004000200b40105510004d72000000807000000ff03fffffffffffff00100000001010000000000010000000000000001ffb810000000000080000080000000000407000000080000d000000040000000050400000020000000000000620000000007000000400000000000800100000000089f1abf5f01978b467790f81f8178070000009b55b91601000300000000000009ffff800009002f3de672922ca7287d55e227a85e000029000000085408b300fbffffff000000080001000007000000f8f600000000a243000080010400000000000000000000675b0d41d9af33380b545184138e54a0000000080800000000000000000001ff00200eb7070020007f000000800000000000007f01000000ff7f00000000000580000001010017fbbc930000fa000010000c00000004070000000000200000000809000008090020000000000700020fffc359000002000000000004000000000900000000000a0000000000060000081707000000ff03000000000007000001ff1200000002000000000000020002000401019910ec13000000e5000300000006000100000900000000000020000013037f000000ff7f00000000001022bd9d000000000000adf007117909895d0ffdc701d59f03d529d940ca2c02eaaa04a8e080b422265e02ae1817f396d57182598287b386ff8cdad692ef98b45b5f7d302a9c27a7e7e5501a583f3a35e2833cd7ed3c5ecae0148ee8e7b69342c9a20caee6d01df95a395d92aca5a9620062d353429dd782684ed3e695921980b1f20e4ad251e1e08156283a14deb206ed12cc3f684847d788b083d3321d7cbfa07b5e1b8e3fb37ec8c429e2cbbfec27a9660c7026588442f5f9f4557511ec050d7a43ed56192fdb1f50cf3f8d9f1b62f596024f8c496cb2f4ea1ff3cefe5bb7b229ec4b81b626f53eed9ffe419ccf45f6bd19857c8c40ad05c2a8924dd25aafec45"], 0x1ec}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) accept$packet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) 13:45:45 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 868.730464][ T26] kauditd_printk_skb: 12 callbacks suppressed [ 868.730483][ T26] audit: type=1804 audit(1582811145.030:266): pid=23211 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1365/bus" dev="sda1" ino=16593 res=1 [ 868.769881][ T26] audit: type=1804 audit(1582811145.040:267): pid=23211 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1365/bus" dev="sda1" ino=16593 res=1 13:45:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x8, &(0x7f0000000040)=0x80000001, 0x4) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffffff7bf, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:45:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x8, &(0x7f0000000040)=0x80000001, 0x4) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffffff7bf, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13:45:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={[{@shortname_lower='shortname=lower'}]}) 13:45:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(0xffffffffffffffff, r4, 0x0, 0xa198) 13:45:45 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(0xffffffffffffffff) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000540)='./file0\x00', 0x9000018d) r1 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r1, r0, 0x0, 0xa198) [ 869.543594][ T26] audit: type=1800 audit(1582811145.840:268): pid=23211 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16593 res=0 [ 869.550074][T23320] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 869.572048][T23320] FAT-fs (loop1): Filesystem has been set read-only [ 869.579553][T23320] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 869.600274][T23433] FAT-fs (loop4): bogus number of reserved sectors [ 869.607204][T23433] FAT-fs (loop4): Can't find a valid FAT filesystem 13:45:46 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 869.675840][T23433] FAT-fs (loop4): bogus number of reserved sectors [ 869.682738][T23433] FAT-fs (loop4): Can't find a valid FAT filesystem 13:45:46 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={[{@shortname_lower='shortname=lower'}]}) [ 869.967396][ T26] audit: type=1804 audit(1582811146.270:269): pid=23454 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1366/bus" dev="sda1" ino=16593 res=1 [ 870.120543][T23460] FAT-fs (loop4): bogus number of reserved sectors [ 870.162023][T23460] FAT-fs (loop4): Can't find a valid FAT filesystem 13:45:46 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:46 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(0xffffffffffffffff) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ustat(0x5, &(0x7f0000000140)) 13:45:46 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(0xffffffffffffffff, r4, 0x0, 0xa198) 13:45:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 870.624942][ T26] audit: type=1804 audit(1582811146.920:270): pid=23471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1367/bus" dev="sda1" ino=16541 res=1 [ 870.780375][T23463] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 870.789229][T23463] FAT-fs (loop1): Filesystem has been set read-only [ 870.796723][T23463] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:47 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 870.826223][ T26] audit: type=1804 audit(1582811146.960:271): pid=23470 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1367/bus" dev="sda1" ino=16541 res=1 [ 870.908522][ T26] audit: type=1804 audit(1582811147.210:272): pid=23482 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1368/bus" dev="sda1" ino=16689 res=1 13:45:47 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00'}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:47 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:47 executing program 4: r0 = memfd_create(0x0, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) r3 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) dup2(0xffffffffffffffff, 0xffffffffffffffff) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x7, 0x4, 0x3c0, 0x1f0, 0x1f0, 0x0, 0x108, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00'}}}, {{@arp={@multicast2, @multicast1, 0x0, 0x0, 0x0, 0x0, {@mac}, {@mac=@dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'team_slave_0\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00'}}, {{@arp={@dev, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'virt_wifi0\x00', 'nr0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x410) socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x0, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(r6, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000480)) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket(0x0, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)=0xd3, 0x4) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup2(0xffffffffffffffff, r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = openat$cgroup_ro(r8, &(0x7f0000000500)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) getpeername$packet(r9, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000001c0)=0x14) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth0_to_team\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'vlan1\x00'}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r10}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x4}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'veth1_to_bond\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x801}, 0x1) r11 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r12 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(r11, 0x4c81, r12) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r0, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0xfffffffffffffffd, 0x2e4a7e412672e7e2, 0x0}, 0x0, 0x8, &(0x7f0000000040)) syz_open_procfs(0x0, &(0x7f0000000140)='auxv\x00') [ 871.306466][ T26] audit: type=1804 audit(1582811147.600:273): pid=23602 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1369/bus" dev="sda1" ino=16643 res=1 [ 871.333101][ T26] audit: type=1804 audit(1582811147.610:274): pid=23602 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1369/bus" dev="sda1" ino=16643 res=1 13:45:47 executing program 4: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0xe, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) 13:45:48 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, 0xffffffffffffffff, 0x0, 0xa198) 13:45:48 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:45:48 executing program 4: close(0xffffffffffffffff) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) fstat(0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x8, &(0x7f0000000040)=0x80000001, 0x4) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffffff7bf, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) [ 871.963079][T23604] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 871.972308][T23604] FAT-fs (loop1): Filesystem has been set read-only [ 871.979729][T23604] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 872.099952][ T26] audit: type=1800 audit(1582811148.400:275): pid=23602 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16643 res=0 13:45:48 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:48 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00'}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:48 executing program 4: 13:45:48 executing program 4: 13:45:49 executing program 4: 13:45:49 executing program 4: 13:45:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:45:49 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:49 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, 0xffffffffffffffff, 0x0, 0xa198) [ 873.081178][T23841] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 873.091354][T23841] FAT-fs (loop1): Filesystem has been set read-only [ 873.099200][T23841] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:49 executing program 4: 13:45:49 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:49 executing program 4: 13:45:49 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00'}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:49 executing program 4: 13:45:50 executing program 4: 13:45:50 executing program 4: 13:45:50 executing program 4: 13:45:50 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:50 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(0xffffffffffffffff) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) 13:45:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, 0xffffffffffffffff, 0x0, 0xa198) [ 874.305836][ T26] kauditd_printk_skb: 5 callbacks suppressed [ 874.305857][ T26] audit: type=1800 audit(1582811150.600:281): pid=23871 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16596 res=0 [ 874.314310][T23878] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 874.340885][T23878] FAT-fs (loop1): Filesystem has been set read-only 13:45:50 executing program 4: [ 874.349969][T23878] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:50 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:50 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:50 executing program 4: [ 874.712785][ T26] audit: type=1804 audit(1582811151.010:282): pid=23910 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1372/bus" dev="sda1" ino=16709 res=1 [ 874.817072][ T26] audit: type=1804 audit(1582811151.010:283): pid=23910 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1372/bus" dev="sda1" ino=16709 res=1 13:45:51 executing program 4: clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0x16) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, 0x0, 0x0) openat$userio(0xffffffffffffff9c, 0x0, 0x0, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) pipe2(0x0, 0x4800) [ 874.903368][T23911] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 874.912113][T23911] FAT-fs (loop1): Filesystem has been set read-only [ 874.919043][T23911] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:51 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff80700000000000000000000000800090018000000", 0x24) 13:45:51 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:51 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(0xffffffffffffffff) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) 13:45:51 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="240000001e005f0214fffffffffffff80700000000000000000000000800090018000000", 0x24) [ 875.512464][ T26] audit: type=1800 audit(1582811151.810:284): pid=23910 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16709 res=0 13:45:51 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:52 executing program 4: ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000000c0)={0x1, 0x5, 0x0, 0x0, 0xfff, 0x2, 0xff, 0x1, 0x80, 0x9, 0x20, 0x8, 0x0, 0x400, 0xdf6, 0x2, 0x85, 0x4, 0x2, [], 0x3, 0x1000}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/kvm\x00', 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) epoll_create1(0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x26, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f0000000180)) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000880)=ANY=[@ANYBLOB="5300000054a6aeabec2e15200000000000000009000000401739c95406a382db9820000004003b08d403ffff633b3b11964f49e630003d736d24c3f2c876d699016b20000004000000200000c7ec6e26040000080000ab31c3a45780fa9dcf6af9d8bbede53b853b807511e7330a87d1e059055d9b5814ba0ce3c828daedc8255b894612b2e32294ce3091a9b66479d138a3a9b124bb0bc65ae2a353290658fa28fdfdff01ba22a2901dbbd866a3cc6fbdc105943102c7933ae54ae764501e640afa5a95c41b228ec7b7cc768be7aa4e7195e74d8acb5bf6c8fc595133f3cebc12a50c4cebbe064687f9d24f0c58e26147a597e614fbb6ab223a00b5205eea65f80600000000000000044a9fdbf7a95e5252d3ba8ed7696c313fcad9b04fba3061492a8bbb3d0000000000000000000000791fbf072329e5c9bdbf4dbbf6ea38dcd7c827763d608ba249e36056e7d9133e0ceb65534fe9a3cffc07485d7320e191a9c97a7a89d159e1ca"], 0x16a) r2 = syz_open_dev$media(&(0x7f0000000280)='/dev/media#\x00', 0x1ff, 0x777770c5fbbf9de8) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f00000002c0)) write$cgroup_pid(r2, &(0x7f00000002c0)=r3, 0x12) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffdac) r5 = openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_G_ENC_INDEX(r5, 0x8818564c, &(0x7f00000010c0)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000200)="460f300f07c483614804ee08440f20c03506000000440f22c0c402f93473230f09f20f013cb9b805000000b9c00000000f01d90fc728c4c1f9e79f2e000000", 0x3f}], 0x1, 0x5e, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x5}, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r7 = syz_open_procfs(0x0, &(0x7f0000000180)='status\x00') umount2(&(0x7f0000000300)='./file0\x00', 0xb8eb6cddad06f074) preadv(r7, &(0x7f00000017c0), 0x1b4, 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', r7, 0x0, 0x0) getpeername$l2tp6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000040)=0x20) [ 875.744461][T24132] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 875.753360][T24132] FAT-fs (loop5): Filesystem has been set read-only [ 875.760441][T24132] FAT-fs (loop5): error, fat_free_clusters: deleting FAT entry beyond EOF 13:45:52 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 876.061686][T24150] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 876.071334][T24150] FAT-fs (loop1): Filesystem has been set read-only [ 876.078080][T24150] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:52 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x4000000000008d}, 0x0) sched_setattr(0x0, 0x0, 0x0) pipe(&(0x7f0000000200)) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x0, 0xfffffffffffffffb}, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6000, 0x1) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='squashfs\x00', 0x0, 0x0) io_setup(0x4, 0x0) [ 876.204295][ T26] audit: type=1804 audit(1582811152.500:285): pid=24258 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1373/bus" dev="sda1" ino=16676 res=1 13:45:52 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:52 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 876.302584][ T26] audit: type=1804 audit(1582811152.510:286): pid=24258 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1373/bus" dev="sda1" ino=16676 res=1 [ 876.369409][ T2517] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 876.380415][T24263] SQUASHFS error: squashfs_read_data failed to read block 0x0 [ 876.387912][T24263] unable to read squashfs_super_block [ 876.398578][ T2517] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 876.409507][T24263] SQUASHFS error: squashfs_read_data failed to read block 0x0 [ 876.417008][T24263] unable to read squashfs_super_block 13:45:52 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x4000000000008d}, 0x0) sched_setattr(0x0, 0x0, 0x0) pipe(&(0x7f0000000200)) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x0, 0xfffffffffffffffb}, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6000, 0x1) clone(0x26100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000080)=@filename='./file0\x00', &(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='squashfs\x00', 0x0, 0x0) io_setup(0x4, 0x0) 13:45:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(0xffffffffffffffff) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, r0, 0x0, 0xa198) [ 876.645420][ T2518] blk_update_request: I/O error, dev loop9, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 876.661907][T24277] SQUASHFS error: squashfs_read_data failed to read block 0x0 [ 876.669995][T24277] unable to read squashfs_super_block [ 876.737001][T24273] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 876.745744][T24273] FAT-fs (loop5): Filesystem has been set read-only [ 876.752477][T24273] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:45:53 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:53 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000300)={0x0, 0x0, 0xffffffffffff3ffc}, 0x4) dup(0xffffffffffffffff) dup(0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e92b7abafc47d822996f60e4"}, 0x1c) sendmmsg(r1, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0x0) 13:45:53 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 876.983255][ T26] audit: type=1800 audit(1582811153.280:287): pid=24258 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16676 res=0 [ 877.155830][T24291] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 877.164674][T24291] FAT-fs (loop1): Filesystem has been set read-only [ 877.171593][T24291] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:53 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000300)={0x0, 0x0, 0xffffffffffff3ffc}, 0x4) dup(0xffffffffffffffff) dup(0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e92b7abafc47d822996f60e4"}, 0x1c) sendmmsg(r1, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0x0) [ 877.261920][ T26] audit: type=1804 audit(1582811153.560:288): pid=24399 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1374/bus" dev="sda1" ino=16657 res=1 [ 877.287205][ T26] audit: type=1804 audit(1582811153.560:289): pid=24399 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1374/bus" dev="sda1" ino=16657 res=1 13:45:53 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:53 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xa198) [ 877.702712][T24409] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 877.711444][T24409] FAT-fs (loop5): Filesystem has been set read-only [ 877.718158][T24409] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:45:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:54 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 878.056772][ T26] audit: type=1800 audit(1582811154.360:290): pid=24399 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16657 res=0 13:45:54 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 878.258438][T24425] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 878.267296][T24425] FAT-fs (loop1): Filesystem has been set read-only [ 878.274043][T24425] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:54 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:54 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:55 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xa198) 13:45:55 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:55 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 879.187991][T24442] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 879.196830][T24442] FAT-fs (loop5): Filesystem has been set read-only [ 879.204407][T24442] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:45:55 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:55 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) [ 879.612669][T24463] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 879.621434][T24463] FAT-fs (loop1): Filesystem has been set read-only [ 879.628175][T24463] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 879.641884][ T26] kauditd_printk_skb: 3 callbacks suppressed 13:45:55 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 879.641909][ T26] audit: type=1804 audit(1582811155.940:294): pid=24471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1376/bus" dev="sda1" ino=16631 res=1 13:45:56 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:56 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000540)='./file0\x00', 0x9000018d) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0xa198) [ 880.281379][T24473] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 880.290077][T24473] FAT-fs (loop5): Filesystem has been set read-only [ 880.297408][T24473] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:45:56 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:56 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 880.354858][ T26] audit: type=1804 audit(1582811155.940:295): pid=24471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1376/bus" dev="sda1" ino=16631 res=1 [ 880.410446][ T26] audit: type=1800 audit(1582811156.680:296): pid=24471 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16631 res=0 13:45:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:45:56 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 880.727749][ T26] audit: type=1804 audit(1582811157.030:297): pid=24605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1377/bus" dev="sda1" ino=16624 res=1 13:45:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 880.774829][T24597] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 880.783905][T24597] FAT-fs (loop1): Filesystem has been set read-only [ 880.790696][T24597] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 880.877948][ T26] audit: type=1804 audit(1582811157.140:298): pid=24605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1377/bus" dev="sda1" ino=16624 res=1 13:45:57 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 881.513716][T24612] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 881.522668][T24612] FAT-fs (loop5): Filesystem has been set read-only [ 881.529886][T24612] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:45:57 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 881.545403][ T26] audit: type=1800 audit(1582811157.840:299): pid=24605 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16624 res=0 13:45:58 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:45:58 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 881.937410][T24633] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 881.946060][T24633] FAT-fs (loop1): Filesystem has been set read-only [ 881.952755][T24633] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 882.161852][ T26] audit: type=1804 audit(1582811158.460:300): pid=24650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1378/bus" dev="sda1" ino=16603 res=1 13:45:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 882.251615][ T26] audit: type=1804 audit(1582811158.460:301): pid=24650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1378/bus" dev="sda1" ino=16603 res=1 13:45:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:45:58 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:58 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:45:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:59 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:45:59 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 882.970571][ T26] audit: type=1800 audit(1582811159.270:302): pid=24650 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16603 res=0 [ 883.032201][T24682] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 883.040927][T24682] FAT-fs (loop1): Filesystem has been set read-only [ 883.047787][T24682] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:45:59 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 883.268669][ T26] audit: type=1804 audit(1582811159.570:303): pid=24703 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1379/bus" dev="sda1" ino=16621 res=1 13:45:59 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:45:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:59 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:45:59 executing program 4: socket$netlink(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:45:59 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:00 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:00 executing program 4: socket$netlink(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:00 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:00 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:00 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 883.996030][T24833] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 884.004748][T24833] FAT-fs (loop1): Filesystem has been set read-only [ 884.011452][T24833] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:00 executing program 4: socket$netlink(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:00 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:00 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:00 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:00 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:00 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x2008001) dup3(0xffffffffffffffff, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:00 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:01 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:01 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 885.083200][T24879] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 885.091890][T24879] FAT-fs (loop1): Filesystem has been set read-only [ 885.098646][T24879] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:01 executing program 4: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:01 executing program 4: socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:01 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:01 executing program 4: socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:02 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:02 executing program 4: socket$netlink(0x10, 0x3, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:02 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x2008001) dup3(0xffffffffffffffff, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:02 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 886.386471][T24914] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 886.395272][T24914] FAT-fs (loop1): Filesystem has been set read-only [ 886.403429][T24914] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:02 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x0, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:02 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:03 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x0, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:03 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:03 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x0, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 887.135771][T24945] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 887.144816][T24945] FAT-fs (loop1): Filesystem has been set read-only [ 887.152047][T24945] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:03 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:03 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) fchdir(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:03 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:03 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:03 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x2008001) dup3(0xffffffffffffffff, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:04 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:04 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:46:04 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 888.621523][T24978] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 888.630460][T24978] FAT-fs (loop1): Filesystem has been set read-only [ 888.637756][T24978] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:05 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:05 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:05 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:05 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:05 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:46:06 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 889.931238][T25007] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 889.939991][T25007] FAT-fs (loop1): Filesystem has been set read-only [ 889.946885][T25007] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:06 executing program 2: r0 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x2008001) dup3(r0, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}]) 13:46:06 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:06 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:06 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) r3 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r3) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, r4, 0x0, 0xa198) 13:46:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0b") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:07 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 891.319827][T25136] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 891.329119][T25136] FAT-fs (loop1): Filesystem has been set read-only [ 891.337113][T25136] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:07 executing program 2: r0 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x2008001) dup3(r0, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}]) 13:46:07 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(0x0, 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:07 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:08 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0b") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:08 executing program 2: r0 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x2008001) dup3(r0, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}]) [ 892.212475][T25153] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 892.221484][T25153] FAT-fs (loop5): Filesystem has been set read-only [ 892.229173][T25153] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:46:08 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:08 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0b") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:08 executing program 2: r0 = creat(0x0, 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:08 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:09 executing program 2: r0 = creat(0x0, 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:09 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:09 executing program 2: r0 = creat(0x0, 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:09 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(0x0, 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 893.204650][T25198] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 893.213919][T25198] FAT-fs (loop5): Filesystem has been set read-only [ 893.221458][T25198] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:46:09 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:09 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:09 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:09 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:10 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(0x0, 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 894.322910][T25233] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 894.331972][T25233] FAT-fs (loop5): Filesystem has been set read-only [ 894.339371][T25233] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:46:10 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a0") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:10 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:10 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:11 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a0") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:11 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a0") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:11 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:11 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:11 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 895.455142][T25369] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 895.463952][T25369] FAT-fs (loop5): Filesystem has been set read-only [ 895.471167][T25369] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:46:12 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:12 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:12 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:12 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:12 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:12 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:12 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:13 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:13 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:13 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(0x0, 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:13 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:13 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:13 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:13 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:13 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:14 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:14 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:14 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:14 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:14 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:14 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:14 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 898.443830][ T26] kauditd_printk_skb: 11 callbacks suppressed [ 898.443849][ T26] audit: type=1804 audit(1582811174.740:315): pid=25496 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1397/bus" dev="sda1" ino=16579 res=1 13:46:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 898.486049][ T26] audit: type=1804 audit(1582811174.780:316): pid=25496 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1397/bus" dev="sda1" ino=16579 res=1 13:46:14 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:14 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 898.649650][ T26] audit: type=1804 audit(1582811174.950:317): pid=25508 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1398/bus" dev="sda1" ino=16560 res=1 [ 898.708177][ T26] audit: type=1804 audit(1582811174.980:318): pid=25508 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1398/bus" dev="sda1" ino=16560 res=1 13:46:15 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:15 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(0xffffffffffffffff, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 898.866435][ T26] audit: type=1804 audit(1582811175.170:319): pid=25523 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1399/bus" dev="sda1" ino=16630 res=1 13:46:15 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 898.895286][ T26] audit: type=1804 audit(1582811175.190:320): pid=25523 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1399/bus" dev="sda1" ino=16630 res=1 13:46:15 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(0x0, 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:15 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:15 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x0) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:15 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:15 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 899.108119][ T26] audit: type=1804 audit(1582811175.410:321): pid=25533 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1400/bus" dev="sda1" ino=16557 res=1 [ 899.134405][ T26] audit: type=1804 audit(1582811175.420:322): pid=25533 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1400/bus" dev="sda1" ino=16557 res=1 13:46:15 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x0) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 899.354233][ T26] audit: type=1804 audit(1582811175.650:323): pid=25551 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1401/bus" dev="sda1" ino=16593 res=1 13:46:15 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:15 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:15 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x0) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 899.475782][ T26] audit: type=1804 audit(1582811175.680:324): pid=25551 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1401/bus" dev="sda1" ino=16593 res=1 13:46:15 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:16 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(0xffffffffffffffff, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:16 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(0x0, 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:16 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:16 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(0xffffffffffffffff, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:16 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:16 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(0xffffffffffffffff, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r1, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:17 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:17 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, 0x0) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:17 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(0x0, 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:17 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:17 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, 0x0) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:17 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:17 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:17 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, 0x0) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:17 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, 0xffffffffffffffff, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:17 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:18 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:18 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:18 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:18 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(0xffffffffffffffff, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:18 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:18 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:19 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, 0x0, 0x0) 13:46:19 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:19 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, 0x0, 0x0) 13:46:19 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:19 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:19 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, 0x0, 0x0) 13:46:19 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:19 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:19 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 903.823921][ T26] kauditd_printk_skb: 20 callbacks suppressed [ 903.823941][ T26] audit: type=1804 audit(1582811180.120:345): pid=25732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir608661082/syzkaller.84RY3O/1134/file0/file0" dev="loop1" ino=232 res=1 [ 903.870197][ T26] audit: type=1800 audit(1582811180.160:346): pid=25703 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16544 res=0 13:46:20 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:20 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:20 executing program 5: r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:20 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:20 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 904.286028][ T26] audit: type=1804 audit(1582811180.580:347): pid=25746 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1411/bus" dev="sda1" ino=16571 res=1 [ 904.400385][ T26] audit: type=1804 audit(1582811180.630:348): pid=25746 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1411/bus" dev="sda1" ino=16571 res=1 13:46:20 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x0, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:20 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:20 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x0, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) [ 904.923172][ T26] audit: type=1804 audit(1582811181.220:349): pid=25770 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir608661082/syzkaller.84RY3O/1135/file0/file0" dev="loop1" ino=234 res=1 13:46:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x0, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:21 executing program 5: r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 905.072443][ T26] audit: type=1800 audit(1582811181.370:350): pid=25746 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16571 res=0 13:46:21 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x0) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x0, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:21 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 905.412719][ T26] audit: type=1804 audit(1582811181.710:351): pid=25787 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1412/bus" dev="sda1" ino=16600 res=1 [ 905.480379][ T26] audit: type=1804 audit(1582811181.740:352): pid=25787 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1412/bus" dev="sda1" ino=16600 res=1 13:46:21 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:21 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x0, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x0, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f030035"}}}}, 0x6a) 13:46:22 executing program 5: r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:22 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x0) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3}}}}, 0x26) 13:46:22 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:22 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 906.608972][ T26] audit: type=1804 audit(1582811182.910:353): pid=25822 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1413/bus" dev="sda1" ino=16556 res=1 [ 906.703322][ T26] audit: type=1804 audit(1582811182.910:354): pid=25822 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1413/bus" dev="sda1" ino=16556 res=1 13:46:23 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:23 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3}}}}, 0x26) 13:46:23 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:23 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3}}}}, 0x26) 13:46:23 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:23 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x0) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:23 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x3e, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b085"}}}}, 0x48) 13:46:24 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x3e, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b085"}}}}, 0x48) 13:46:24 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:24 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x3e, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b085"}}}}, 0x48) 13:46:24 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08e"}}}}, 0x59) 13:46:25 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x0, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:25 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 908.891031][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 908.891071][ T26] audit: type=1804 audit(1582811185.190:359): pid=25899 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1415/bus" dev="sda1" ino=16694 res=1 [ 908.956057][ T26] audit: type=1804 audit(1582811185.230:360): pid=25899 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1415/bus" dev="sda1" ino=16694 res=1 13:46:25 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08e"}}}}, 0x59) 13:46:25 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, 0x0, 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:25 executing program 5: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:25 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x4f, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08e"}}}}, 0x59) 13:46:25 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:25 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 909.671913][T25925] overlayfs: failed to resolve './file0': -2 13:46:26 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x0, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 909.704163][ T26] audit: type=1800 audit(1582811186.000:361): pid=25899 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16694 res=0 13:46:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc"}}}}, 0x62) [ 909.832567][ T26] audit: type=1804 audit(1582811186.130:362): pid=25932 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1416/bus" dev="sda1" ino=16692 res=1 [ 909.885095][ T26] audit: type=1804 audit(1582811186.170:363): pid=25932 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1416/bus" dev="sda1" ino=16692 res=1 13:46:26 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, 0x0, 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc"}}}}, 0x62) 13:46:26 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc"}}}}, 0x62) 13:46:26 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:26 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x0, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:26 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 910.733154][T25959] overlayfs: failed to resolve './file0': -2 13:46:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee6334"}}}}, 0x66) [ 911.011098][ T26] audit: type=1804 audit(1582811187.310:364): pid=25967 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1417/bus" dev="sda1" ino=16726 res=1 [ 911.110858][ T26] audit: type=1804 audit(1582811187.310:365): pid=25967 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1417/bus" dev="sda1" ino=16726 res=1 13:46:27 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, 0x0, 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:27 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee6334"}}}}, 0x66) 13:46:27 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 911.703589][T25989] overlayfs: failed to resolve './file0': -2 13:46:28 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 911.794054][ T26] audit: type=1800 audit(1582811188.090:366): pid=25967 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16726 res=0 13:46:28 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, 0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:28 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee6334"}}}}, 0x66) [ 911.942966][T25995] overlayfs: failed to resolve './file0': -2 [ 911.995315][T25984] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 912.004083][T25984] FAT-fs (loop5): Filesystem has been set read-only [ 912.010894][T25984] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 912.092544][ T26] audit: type=1804 audit(1582811188.390:367): pid=26002 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1418/bus" dev="sda1" ino=16726 res=1 [ 912.155079][ T26] audit: type=1804 audit(1582811188.420:368): pid=26002 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1418/bus" dev="sda1" ino=16726 res=1 13:46:28 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f03"}}}}, 0x68) 13:46:28 executing program 5: prlimit64(0x0, 0xe, 0x0, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:28 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[], 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:28 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f03"}}}}, 0x68) 13:46:29 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:29 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, 0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 912.953390][T26030] overlayfs: failed to resolve './file0': -2 13:46:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f03"}}}}, 0x68) 13:46:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5f, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f0300"}}}}, 0x69) 13:46:29 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:29 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[], 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5f, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f0300"}}}}, 0x69) 13:46:30 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:30 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:30 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, 0x0) socket$inet6(0xa, 0x400000000001, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:30 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="080db5055e0bcfe847a071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r1, &(0x7f0000000240)={@void, @val={0x3}, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x5f, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @echo_reply={0x0, 0x0, 0x0, 0x4b, 0x9b3, "2b1efa78bf54d8a46c4627b94c216a4ffbb54a1c4c1713688c7f029aaf0019c8b0857e354a7885962b2fd5736ca1f85f0be08ef6dd0530796b63cdcc71ee63341f0300"}}}}, 0x69) [ 913.996982][T26065] overlayfs: failed to resolve './file0': -2 [ 914.155697][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 914.155716][ T26] audit: type=1804 audit(1582811190.450:372): pid=26074 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1420/bus" dev="sda1" ino=16735 res=1 [ 914.224060][ T26] audit: type=1804 audit(1582811190.470:373): pid=26074 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1420/bus" dev="sda1" ino=16735 res=1 13:46:30 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='cpuacct.stat\x00', 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400012) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1102c, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000380)='syz0\x00', 0x200002, 0x0) openat$cgroup(r2, &(0x7f00000004c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup/syz0\x00', 0x200002, 0x0) r3 = gettid() r4 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f0000000040)=@ipx={0x4, 0x1, 0x101, "2b04ec665b4b", 0xff}, 0x80, 0x0}, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r5 = socket$kcm(0x11, 0x7, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10d, 0xb, &(0x7f0000000000)=r6, 0xb) openat$cgroup_ro(r6, 0x0, 0x0, 0x0) r7 = openat$cgroup(r6, &(0x7f0000000540)='syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r7, 0xa9bff5772b9e2466, 0x0, 0x4, 0x0}, 0xfffffe14) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x62d7bea61e7c88eb) socket$kcm(0xa, 0x6, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000240)) sendmsg(r4, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100)=r3, 0xfffffffffffffec6) socketpair(0x1, 0x2000000003, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x23, 0x16, &(0x7f0000000200)="dab7655af780f6dd2dd38c7f2848ba7e2f182b349ca6fa76a8921aed6c98c7806280b0", &(0x7f0000000240)=""/22, 0x2, 0x0, 0x95, 0x8b, &(0x7f00000002c0)="c796e54990825cd5827330223fd2a4714c0a01cc294d4c0df4ab4961230462093d0fd5d6fc0d555ada36d3a5123b057f76378740b3a8a8161e46d6841581e001bec0f45baf423101cee8ef1dcdd65a8c45ccb11f51c3331dfcd74a785c2b905293e6410d00392c1ee4736de7dcd9048f2f449c7ce7f89937a67b9c250e0a668b8b7a0325eb3f3d804a4a334fec96f88500810ae818", &(0x7f00000003c0)="da9325d2b248c00bb44445e87018e97ba8df06a7e4838d008fea53681452f21c4cf7cbece2d4f038e93f67db3616ae6510efb236a21e7e94d40869b74e648adfa94bd398b982e56d242f36b5280bf9e1d5aaf805c3437de6f0ac3c64862bb0e706f0bc2019858a6f47f4b5e823b770501bc948f4a9bb49b750cd9a92154f099a063c55e083182a22ab9764"}, 0x40) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x0, 0x5, 0x0, 0x9, 0x9c, &(0x7f0000000580)="a6c9157cced850156b", &(0x7f0000001700)="6aa93d208d67bc734dce75854727883cac958a7d556aae64087a306e60490859b3c8f71d36727995b0a5a340affef72c334adaec120563d610157d7a110b67c4de3ab98224cc7f7e7f25d72a20d3cc8330681741d13103b43947a6bcdc68f212808144c1199784e49980dabad6df98bdb13bdb6aba4469b60ba2c16bd62fc4146277907cb9cf49bb09f8f26a08e172c89a8c9ebce43e576ab0b54716"}, 0x40) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89f1, &(0x7f0000000000)='ip6gre0\x00') r10 = gettid() r11 = getpid() sched_setscheduler(r11, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x8, 0x26, 0x4e, 0x0, 0x0, 0x3, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={&(0x7f00000000c0), 0x4}, 0x20a04, 0x2, 0x8, 0x8, 0xff, 0x4, 0x80}, r11, 0x40000002, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, r10, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r12 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r12, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000100)="2e0000001e000500ed0080648c6394f27e31d20004000b404b48000001000080000000000300f88000f01700d0bd", 0x2e}], 0x1}, 0x0) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000640)='cpuacct.stat\x00', 0x26e1, 0x0) r14 = socket$kcm(0x2, 0x7, 0x0) setsockopt$sock_attach_bpf(r14, 0x1, 0x3e, &(0x7f00000002c0)=r13, 0x28e) openat$cgroup_ro(r13, &(0x7f00000006c0)='cgroup.controllers\x00', 0x26e1, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$sock_kcm_SIOCKCMATTACH(r9, 0x89e0, &(0x7f0000000500)={r5}) 13:46:30 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:30 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[], 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:31 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:31 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:31 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='cpuacct.stat\x00', 0x0, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.controllers\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400012) perf_event_open(0x0, 0xffffffffffffffff, 0x0, r1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1102c, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000380)='syz0\x00', 0x200002, 0x0) openat$cgroup(r2, &(0x7f00000004c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup/syz0\x00', 0x200002, 0x0) r3 = gettid() r4 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f0000000040)=@ipx={0x4, 0x1, 0x101, "2b04ec665b4b", 0xff}, 0x80, 0x0}, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r5 = socket$kcm(0x11, 0x7, 0x0) r6 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x2761, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10d, 0xb, &(0x7f0000000000)=r6, 0xb) openat$cgroup_ro(r6, 0x0, 0x0, 0x0) r7 = openat$cgroup(r6, &(0x7f0000000540)='syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r7, 0xa9bff5772b9e2466, 0x0, 0x4, 0x0}, 0xfffffe14) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x62d7bea61e7c88eb) socket$kcm(0xa, 0x6, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000240)) sendmsg(r4, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000100)=r3, 0xfffffffffffffec6) socketpair(0x1, 0x2000000003, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x23, 0x16, &(0x7f0000000200)="dab7655af780f6dd2dd38c7f2848ba7e2f182b349ca6fa76a8921aed6c98c7806280b0", &(0x7f0000000240)=""/22, 0x2, 0x0, 0x95, 0x8b, &(0x7f00000002c0)="c796e54990825cd5827330223fd2a4714c0a01cc294d4c0df4ab4961230462093d0fd5d6fc0d555ada36d3a5123b057f76378740b3a8a8161e46d6841581e001bec0f45baf423101cee8ef1dcdd65a8c45ccb11f51c3331dfcd74a785c2b905293e6410d00392c1ee4736de7dcd9048f2f449c7ce7f89937a67b9c250e0a668b8b7a0325eb3f3d804a4a334fec96f88500810ae818", &(0x7f00000003c0)="da9325d2b248c00bb44445e87018e97ba8df06a7e4838d008fea53681452f21c4cf7cbece2d4f038e93f67db3616ae6510efb236a21e7e94d40869b74e648adfa94bd398b982e56d242f36b5280bf9e1d5aaf805c3437de6f0ac3c64862bb0e706f0bc2019858a6f47f4b5e823b770501bc948f4a9bb49b750cd9a92154f099a063c55e083182a22ab9764"}, 0x40) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x0, 0x5, 0x0, 0x9, 0x9c, &(0x7f0000000580)="a6c9157cced850156b", &(0x7f0000001700)="6aa93d208d67bc734dce75854727883cac958a7d556aae64087a306e60490859b3c8f71d36727995b0a5a340affef72c334adaec120563d610157d7a110b67c4de3ab98224cc7f7e7f25d72a20d3cc8330681741d13103b43947a6bcdc68f212808144c1199784e49980dabad6df98bdb13bdb6aba4469b60ba2c16bd62fc4146277907cb9cf49bb09f8f26a08e172c89a8c9ebce43e576ab0b54716"}, 0x40) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89f1, &(0x7f0000000000)='ip6gre0\x00') r10 = gettid() r11 = getpid() sched_setscheduler(r11, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x8, 0x26, 0x4e, 0x0, 0x0, 0x3, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={&(0x7f00000000c0), 0x4}, 0x20a04, 0x2, 0x8, 0x8, 0xff, 0x4, 0x80}, r11, 0x40000002, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, r10, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r12 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r12, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000100)="2e0000001e000500ed0080648c6394f27e31d20004000b404b48000001000080000000000300f88000f01700d0bd", 0x2e}], 0x1}, 0x0) r13 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000640)='cpuacct.stat\x00', 0x26e1, 0x0) r14 = socket$kcm(0x2, 0x7, 0x0) setsockopt$sock_attach_bpf(r14, 0x1, 0x3e, &(0x7f00000002c0)=r13, 0x28e) openat$cgroup_ro(r13, &(0x7f00000006c0)='cgroup.controllers\x00', 0x26e1, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$sock_kcm_SIOCKCMATTACH(r9, 0x89e0, &(0x7f0000000500)={r5}) [ 914.976051][ T26] audit: type=1800 audit(1582811191.270:374): pid=26074 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16735 res=0 13:46:31 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 915.059527][T26199] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.4'. [ 915.114551][T26199] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 [ 915.195064][ T26] audit: type=1804 audit(1582811191.490:375): pid=26209 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1421/bus" dev="sda1" ino=16742 res=1 [ 915.232649][ T26] audit: type=1804 audit(1582811191.530:376): pid=26209 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1421/bus" dev="sda1" ino=16742 res=1 13:46:31 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast1, @in6=@mcast1, 0x0, 0x0, 0x4e23, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xe5, 0xfffffffc, 0xffffffff}}, 0xe8) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) write(r0, 0x0, 0x0) 13:46:31 executing program 4: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) dup(0xffffffffffffffff) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000005c0)) sendto$inet6(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) socket(0x0, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) dup(0xffffffffffffffff) getsockname$packet(0xffffffffffffffff, &(0x7f00000007c0), 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket(0x200000000000011, 0x0, 0x0) setsockopt$packet_int(r0, 0x107, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000300)={0x0, 0x0, 0xffffffffffff3ffc}, 0x4) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000100)=0x6, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e92b7abafc47d822996f60e4"}, 0x1c) sendmmsg(r2, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0xe00) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x12) 13:46:31 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x0, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:31 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:32 executing program 3: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:32 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:32 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:32 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) [ 916.133602][T26438] overlayfs: failed to resolve './file1': -2 [ 916.262594][ T26] audit: type=1804 audit(1582811192.560:377): pid=26449 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1422/bus" dev="sda1" ino=16741 res=1 [ 916.345299][ T26] audit: type=1804 audit(1582811192.610:378): pid=26454 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1422/bus" dev="sda1" ino=16741 res=1 13:46:32 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:32 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:32 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:33 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:33 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:33 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:33 executing program 3: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:33 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:33 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000080), 0x0}, 0x20) 13:46:33 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000080), 0x0}, 0x20) [ 917.161215][T26585] overlayfs: failed to resolve './file1': -2 13:46:33 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000080), 0x0}, 0x20) 13:46:33 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r0, &(0x7f0000000080), 0x0}, 0x20) 13:46:33 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r0, &(0x7f0000000080), 0x0}, 0x20) [ 917.430950][ T26] audit: type=1804 audit(1582811193.730:379): pid=26601 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1423/bus" dev="sda1" ino=16719 res=1 13:46:33 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:33 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r0, &(0x7f0000000080), 0x0}, 0x20) [ 917.509238][ T26] audit: type=1804 audit(1582811193.780:380): pid=26606 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1423/bus" dev="sda1" ino=16719 res=1 13:46:34 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x0) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:34 executing program 4: bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r0}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:34 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:34 executing program 4: bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r0}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:34 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(0x0, 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:34 executing program 3: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:34 executing program 4: bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r0}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) [ 918.336605][T26633] overlayfs: failed to resolve './file1': -2 [ 918.348479][T26632] overlayfs: failed to resolve './file1': -2 13:46:34 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:34 executing program 4: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) [ 918.539394][ T26] audit: type=1804 audit(1582811194.840:381): pid=26643 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1424/bus" dev="sda1" ino=16726 res=1 13:46:34 executing program 4: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:35 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(0x0, 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:35 executing program 4: r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:35 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc"], 0x7b) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:35 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x0, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:35 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:35 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x0, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:35 executing program 3: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:35 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(0x0, 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) [ 919.493865][T26686] overlayfs: failed to resolve './file1': -2 [ 919.494710][T26678] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 919.508631][T26678] FAT-fs (loop1): Filesystem has been set read-only [ 919.516050][T26678] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:35 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x0, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) [ 919.539089][ T26] kauditd_printk_skb: 1 callbacks suppressed [ 919.539107][ T26] audit: type=1804 audit(1582811195.840:383): pid=26688 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1426/bus" dev="sda1" ino=16732 res=1 13:46:35 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x0, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:35 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:36 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x0, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) [ 919.661575][T26697] overlayfs: failed to resolve './file1': -2 13:46:36 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:36 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x0, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) [ 919.936463][ T26] audit: type=1804 audit(1582811196.240:384): pid=26717 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1427/bus" dev="sda1" ino=16760 res=1 13:46:36 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc"], 0x7b) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:36 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x0, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:36 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x0, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:36 executing program 3: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:36 executing program 0: mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 920.519032][T26728] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 920.527902][T26728] FAT-fs (loop1): Filesystem has been set read-only [ 920.535053][T26728] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:37 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x0, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:37 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) [ 920.675857][T26735] overlayfs: failed to resolve './file1': -2 [ 920.765557][T26738] overlayfs: failed to resolve './file1': -2 13:46:37 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:37 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:37 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:37 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:37 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc"], 0x7b) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:37 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r0, &(0x7f0000000080), 0x0}, 0x20) [ 921.231335][ T26] audit: type=1804 audit(1582811197.530:385): pid=26763 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1428/bus" dev="sda1" ino=16569 res=1 13:46:37 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r0, &(0x7f0000000080), 0x0}, 0x20) 13:46:37 executing program 3: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 921.674302][T26773] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 921.683163][T26773] FAT-fs (loop1): Filesystem has been set read-only [ 921.690371][T26773] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:38 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r0, &(0x7f0000000080), 0x0}, 0x20) 13:46:38 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 921.749713][T26781] overlayfs: failed to resolve './file1': -2 13:46:38 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) getpid() sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r3, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r3, r2, 0x0, 0xa198) 13:46:38 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r0}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) [ 921.929003][T26789] overlayfs: failed to resolve './file1': -2 [ 922.028190][ T26] audit: type=1800 audit(1582811198.330:386): pid=26763 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16569 res=0 13:46:38 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:38 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r0}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:38 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dc"], 0xb9) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 922.266492][ T26] audit: type=1804 audit(1582811198.570:387): pid=26807 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1429/bus" dev="sda1" ino=16776 res=1 13:46:38 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r0}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:38 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x0, 0x0}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:38 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 922.681396][T26818] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 922.691505][T26818] FAT-fs (loop1): Filesystem has been set read-only [ 922.698907][T26818] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:39 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x0, 0x0}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:39 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:39 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x0, 0x0}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:39 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:39 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) [ 922.941757][T26935] overlayfs: failed to resolve './file1': -2 13:46:39 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) [ 923.063697][ T26] audit: type=1800 audit(1582811199.360:388): pid=26807 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16776 res=0 13:46:39 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:39 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) [ 923.361786][ T26] audit: type=1804 audit(1582811199.660:389): pid=26956 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1430/bus" dev="sda1" ino=16764 res=1 13:46:39 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dc"], 0xb9) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:39 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) [ 923.389133][ T26] audit: type=1804 audit(1582811199.680:390): pid=26956 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1430/bus" dev="sda1" ino=16764 res=1 13:46:39 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:40 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)}, 0x10) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040), 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000080), 0x0}, 0x20) 13:46:40 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 923.742962][T26968] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 923.751823][T26968] FAT-fs (loop1): Filesystem has been set read-only [ 923.759559][T26968] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:40 executing program 0: mkdir(0x0, 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:40 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) 13:46:40 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:40 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) [ 923.994927][T26984] overlayfs: failed to resolve './file1': -2 13:46:40 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) [ 924.157188][ T26] audit: type=1800 audit(1582811200.460:391): pid=26956 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16764 res=0 13:46:40 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:40 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000080), 0x0}, 0x20) 13:46:40 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dc"], 0xb9) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:40 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000080), 0x0}, 0x20) 13:46:41 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={0xffffffffffffffff, &(0x7f0000000080), 0x0}, 0x20) 13:46:41 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 924.834984][T27009] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 924.844376][T27009] FAT-fs (loop1): Filesystem has been set read-only [ 924.852031][T27009] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:41 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 924.912349][ T26] audit: type=1804 audit(1582811201.210:392): pid=27016 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1431/bus" dev="sda1" ino=16760 res=1 13:46:41 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 925.018720][ T26] audit: type=1804 audit(1582811201.280:393): pid=27016 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1431/bus" dev="sda1" ino=16760 res=1 13:46:41 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, 0x0, 0x0}, 0x20) 13:46:41 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, 0x0, 0x0}, 0x20) 13:46:41 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f"], 0xd8) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:41 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, 0x0, 0x0}, 0x20) [ 925.660507][ T26] audit: type=1800 audit(1582811201.960:394): pid=27016 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16760 res=0 [ 925.856214][T27048] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 925.864906][T27048] FAT-fs (loop1): Filesystem has been set read-only [ 925.872401][T27048] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:42 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(0x0, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000000), 0x200a00}]) 13:46:42 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:42 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:42 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:42 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) 13:46:42 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 926.049529][T27062] overlayfs: failed to resolve './file0': -2 13:46:42 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={r1}, 0xc) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r2, &(0x7f0000000080), 0x0}, 0x20) [ 926.136052][ T26] audit: type=1804 audit(1582811202.430:395): pid=27068 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1432/bus" dev="sda1" ino=16749 res=1 [ 926.202700][ T26] audit: type=1804 audit(1582811202.500:396): pid=27074 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1432/bus" dev="sda1" ino=16749 res=1 13:46:42 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f0000001f40)={&(0x7f0000001e00), 0xc, &(0x7f0000001e40)={&(0x7f0000001f80)=ANY=[@ANYBLOB="6400000001080102000000000000000007000007050003008800000034000480080002400000007f083202400000000708000140000000010800024000000010080001400000000308000140000000050900010073797a310000000006000240890d00004fc8a27065c4d29a7c048bb5108138d361aca5a325fcb612b72452dc9538bf062df199e027a061e696ff07490f970998f2024fa3dafc2c7b0267c5ad79af22b28d7cb11acf72e4229600f7a92e2d13"], 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x20000000) 13:46:42 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f"], 0xd8) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:42 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000300)={0x0, 0x0, 0xffffffffffff3ffc}, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e92b7abafc47d822996f60e4"}, 0x1c) sendmmsg(r1, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0x0) 13:46:43 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:43 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 927.009657][ T26] audit: type=1800 audit(1582811203.310:397): pid=27074 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16749 res=0 [ 927.046000][T27075] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 927.059985][T27075] FAT-fs (loop5): Filesystem has been set read-only [ 927.069396][T27075] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) [ 927.077831][T27160] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 927.077905][T27160] FAT-fs (loop1): Filesystem has been set read-only [ 927.093635][T27160] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 927.146439][T27198] overlayfs: failed to resolve './file0': -2 13:46:43 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x0, 0x0) 13:46:43 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x802, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getpeername$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x12) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000540)={@dev, @loopback, @local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c200a2, r4}) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @rand_addr="51c215b0b4fc01ac79d54b52e1ee3196"}, 0x1c) 13:46:43 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 927.306037][ T26] audit: type=1804 audit(1582811203.600:398): pid=27212 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1433/bus" dev="sda1" ino=16793 res=1 [ 927.490580][ T26] audit: type=1804 audit(1582811203.660:399): pid=27219 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1433/bus" dev="sda1" ino=16793 res=1 13:46:43 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket(0xa, 0x802, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) getpeername$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x12) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000540)={@dev, @loopback, @local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c200a2, r4}) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @rand_addr="51c215b0b4fc01ac79d54b52e1ee3196"}, 0x1c) 13:46:44 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000001380)='keyring\x00', 0x0, 0x0, 0x0, 0x0) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000007900), 0x4000099, 0x0) 13:46:44 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f"], 0xd8) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:44 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x0, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:44 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:44 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 928.103655][ T26] audit: type=1800 audit(1582811204.400:400): pid=27219 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16793 res=0 [ 928.160379][T27337] overlayfs: failed to resolve './file0': -2 13:46:44 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x0, 0x0) [ 928.320053][T27335] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 928.328845][T27335] FAT-fs (loop1): Filesystem has been set read-only [ 928.336530][T27335] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 928.384170][T27447] overlayfs: failed to resolve './file0': -2 13:46:44 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000001380)='keyring\x00', 0x0, 0x0, 0x0, 0x0) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000007900), 0x4000099, 0x0) 13:46:44 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000001380)='keyring\x00', 0x0, 0x0, 0x0, 0x0) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000007900), 0x4000099, 0x0) 13:46:44 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000001380)='keyring\x00', 0x0, 0x0, 0x0, 0x0) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000007900), 0x4000099, 0x0) 13:46:45 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socket$inet6(0xa, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) creat(0x0, 0x0) open(0x0, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000080)=0x4, 0x4) connect$inet(r0, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) stat(0x0, 0x0) stat(0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x0, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) [ 928.787715][ T26] audit: type=1804 audit(1582811205.090:401): pid=27465 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1434/bus" dev="sda1" ino=16800 res=1 13:46:45 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12"], 0xe7) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:45 executing program 4: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="02070003020000000000000000000000437adfb1eff6a84a8edbaacae3a40a9d8230057d4ae59af95d78a0b0d3acc96aa828e8297d3775dcfb137e8e7d0829dd5bd8bc2d140def68725c1f8898c090b67ddc2ed945f0f5afdd1ec7cfa2d469c6b94a284ced76c0c80b21805911ce9557564c3e4d6b7100cfd1f9960029027b02c1042a6bb1edb0c901f78d475f880b1bdd0a54eaa3111bf748489bed991f9e8eba7883c86d3216897e088715e4159ea897a6cdf9c45d9c93aa5fdbfc43bfc70500e9fb74dbe1108634b9ad72a47447d0ca4f735f8ddc7781c37e1a86ded7c332b355e8111dafa773f00381c29432e48da14f1bc304786e78d6fc153e575f51f70ee15ff90e13e521d01efb4e3e0c4c1040a1810399882ca5f52fb1dd833678e5236c135ce400353b5fecd47bb211b20aaa64050fc711a46085f662b1ce29a46f1f3476d32a36fcf675010cf9b4183dd980d3745de80eb59510b7701b706ec868aae1b9652e72492b504e19659f1a3ba6b97b516e594914253278c1f6c7fd18be684a854f42a7558c8d8f3459fe374dcf8496e2f73df9318dd5cde0dc237c816909408c9288e4e5ab686fab41bd1c1c69f0134900a6e5b627d7358de02ecb67c8b4c3e85039ab68b8acc15bafa9d7e0db69bfeb1411ab8bedc185d5328cc7cbe653b859306e1e5711"], 0x10}}, 0x0) r1 = socket$inet6(0xa, 0x3, 0xfc) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000380)={{{@in6=@remote, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@empty, 0x0, 0x32}, 0x0, @in6=@local, 0x0, 0x0, 0x0, 0x6}}, 0xe8) syz_genetlink_get_family_id$nl80211(0x0) connect$inet6(r1, &(0x7f0000000240)={0xa, 0x0, 0x0, @local, 0x5}, 0x1c) sendmmsg(r1, &(0x7f0000007e00), 0x400000000000058, 0x0) 13:46:45 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:45 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x0, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:45 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 929.183772][T27587] overlayfs: failed to resolve './file0': -2 13:46:45 executing program 4: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007f9, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf32(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="15"], 0x1) splice(r1, 0x0, r0, 0x0, 0x21f, 0x0) [ 929.373824][T27672] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 929.382796][T27672] FAT-fs (loop1): Filesystem has been set read-only [ 929.390300][T27672] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:45 executing program 4: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007f9, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf32(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="15"], 0x1) splice(r1, 0x0, r0, 0x0, 0x21f, 0x0) 13:46:46 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x0, 0x0) 13:46:46 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000300)={0x0, 0x0, 0xffffffffffff3ffc}, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e92b7abafc47d822996f60e4"}, 0x1c) sendmmsg(r1, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0x0) [ 929.993721][ T26] kauditd_printk_skb: 2 callbacks suppressed [ 929.993740][ T26] audit: type=1804 audit(1582811206.290:404): pid=27820 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1435/bus" dev="sda1" ino=16804 res=1 [ 930.112713][ T26] audit: type=1804 audit(1582811206.340:405): pid=27885 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1435/bus" dev="sda1" ino=16804 res=1 13:46:46 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12"], 0xe7) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:46 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:46 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000180)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, &(0x7f0000000140)={'syz', 0x3}, r1) add_key$keyring(&(0x7f0000001380)='keyring\x00', 0x0, 0x0, 0x0, r1) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="f9f1b5250749b2062fc353964dee9184a34e2f4a00be36f7e6aa0a5d6efea276eb700e33fb27c4bcc74e", 0x2a, 0x0) r2 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r2, &(0x7f0000007900), 0x4000099, 0x0) 13:46:46 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:46 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x0, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 930.368322][T27932] overlayfs: failed to resolve './file0': -2 [ 930.615031][T27937] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 930.623932][T27937] FAT-fs (loop1): Filesystem has been set read-only [ 930.631321][T27937] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 930.846215][ T26] audit: type=1800 audit(1582811207.150:406): pid=27885 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16804 res=0 13:46:47 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x0, &(0x7f0000000540)) [ 931.082447][ T26] audit: type=1804 audit(1582811207.380:407): pid=28059 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1436/bus" dev="sda1" ino=16804 res=1 [ 931.141500][ T26] audit: type=1804 audit(1582811207.440:408): pid=28059 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1436/bus" dev="sda1" ino=16804 res=1 13:46:47 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12"], 0xe7) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:47 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000180)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, &(0x7f0000000140)={'syz', 0x3}, r1) add_key$keyring(&(0x7f0000001380)='keyring\x00', 0x0, 0x0, 0x0, r1) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="f9f1b5250749b2062fc353964dee9184a34e2f4a00be36f7e6aa0a5d6efea276eb700e33fb27c4bcc74e", 0x2a, 0x0) r2 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r2, &(0x7f0000007900), 0x4000099, 0x0) 13:46:47 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:47 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:48 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x0, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 931.641319][T28075] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 931.650232][T28075] FAT-fs (loop1): Filesystem has been set read-only [ 931.657868][T28075] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 931.884565][ T26] audit: type=1800 audit(1582811208.180:409): pid=28059 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16804 res=0 13:46:48 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x0, &(0x7f0000000540)) 13:46:48 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c"], 0xef) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:48 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000180)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, &(0x7f0000000140)={'syz', 0x3}, r1) add_key$keyring(&(0x7f0000001380)='keyring\x00', 0x0, 0x0, 0x0, r1) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="f9f1b5250749b2062fc353964dee9184a34e2f4a00be36f7e6aa0a5d6efea276eb700e33fb27c4bcc74e", 0x2a, 0x0) r2 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r2, &(0x7f0000007900), 0x4000099, 0x0) 13:46:48 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:48 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 932.508110][ T26] audit: type=1804 audit(1582811208.800:410): pid=28095 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1437/bus" dev="sda1" ino=16657 res=1 [ 932.665725][T28098] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 932.674527][T28098] FAT-fs (loop1): Filesystem has been set read-only [ 932.682003][T28098] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 932.706150][ T26] audit: type=1804 audit(1582811208.910:411): pid=28101 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1437/bus" dev="sda1" ino=16657 res=1 13:46:49 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 933.284891][ T26] audit: type=1800 audit(1582811209.580:412): pid=28101 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16657 res=0 13:46:49 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c"], 0xef) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:49 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, 0x0, &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:49 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x0, &(0x7f0000000540)) 13:46:49 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9}, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000180)='keyring\x00', 0x0, 0x0, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, &(0x7f0000000140)={'syz', 0x3}, r1) add_key$keyring(&(0x7f0000001380)='keyring\x00', 0x0, 0x0, 0x0, r1) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)="f9f1b5250749b2062fc353964dee9184a34e2f4a00be36f7e6aa0a5d6efea276eb700e33fb27c4bcc74e", 0x2a, 0x0) r2 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r2, &(0x7f0000007900), 0x4000099, 0x0) [ 933.627237][T28119] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 933.636029][T28119] FAT-fs (loop5): Filesystem has been set read-only [ 933.643646][T28119] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:46:50 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:50 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 933.958037][ T26] audit: type=1804 audit(1582811210.260:413): pid=28137 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1438/bus" dev="sda1" ino=16799 res=1 [ 933.995297][T28133] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 934.004228][T28133] FAT-fs (loop1): Filesystem has been set read-only [ 934.011673][T28133] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:51 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:51 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c"], 0xef) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:51 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socket$inet6(0xa, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) creat(0x0, 0x0) open(0x0, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000080)=0x4, 0x4) connect$inet(r0, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) setresgid(0x0, 0x0, 0x0) stat(0x0, 0x0) setresgid(0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x0, 0x0, 0x0) [ 934.723755][T28151] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 934.732827][T28151] FAT-fs (loop5): Filesystem has been set read-only [ 934.740553][T28151] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 17) 13:46:51 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:51 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:51 executing program 4: sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) creat(0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000080)=0x4, 0x4) connect$inet(r0, &(0x7f00000004c0)={0x2, 0x0, @broadcast}, 0x10) setresgid(0x0, 0x0, 0x0) stat(0x0, 0x0) setresgid(0x0, 0x0, 0x0) stat(0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socket(0x0, 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) [ 935.175605][T28276] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 935.184433][T28276] FAT-fs (loop1): Filesystem has been set read-only [ 935.191681][T28276] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:51 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:51 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30}, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f0000000000)='big_key\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000007900), 0x4000099, 0x0) 13:46:52 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[0x0]) 13:46:52 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:52 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:52 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5c"], 0xf3) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:52 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:52 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30}, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f0000000000)='big_key\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000007900), 0x4000099, 0x0) [ 936.201381][T28529] overlayfs: missing 'lowerdir' [ 936.416583][T28537] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 936.425568][T28537] FAT-fs (loop1): Filesystem has been set read-only [ 936.434116][T28537] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:52 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 936.586008][ T26] kauditd_printk_skb: 1 callbacks suppressed [ 936.586025][ T26] audit: type=1804 audit(1582811212.880:415): pid=28550 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1439/bus" dev="sda1" ino=16836 res=1 [ 936.637006][ T26] audit: type=1804 audit(1582811212.940:416): pid=28553 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1439/bus" dev="sda1" ino=16836 res=1 13:46:53 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:46:53 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30}, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f0000000000)='big_key\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000007900), 0x4000099, 0x0) 13:46:53 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:53 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5c"], 0xf3) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 937.409595][ T26] audit: type=1800 audit(1582811213.690:417): pid=28553 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16836 res=0 13:46:53 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 937.522725][T28571] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 937.531777][T28571] FAT-fs (loop1): Filesystem has been set read-only [ 937.539813][T28571] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:53 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[0x0]) [ 937.634669][T28577] overlayfs: missing 'lowerdir' [ 937.741196][ T26] audit: type=1804 audit(1582811214.040:418): pid=28584 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1440/bus" dev="sda1" ino=16849 res=1 13:46:54 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 937.923724][ T26] audit: type=1804 audit(1582811214.090:419): pid=28590 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1440/bus" dev="sda1" ino=16849 res=1 13:46:54 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:54 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:54 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5c"], 0xf3) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:46:54 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x9}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30}, 0x0) r0 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) add_key$keyring(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f0000000000)='big_key\x00', 0x0, 0x0, 0x0, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000080)=@req={0x3fc}, 0x10) sendmmsg(r1, &(0x7f0000007900), 0x4000099, 0x0) [ 938.307364][T28604] overlayfs: missing 'lowerdir' 13:46:54 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 938.528768][ T26] audit: type=1800 audit(1582811214.830:420): pid=28590 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16849 res=0 13:46:54 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[0x0]) [ 938.600132][T28615] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 938.609541][T28615] FAT-fs (loop1): Filesystem has been set read-only [ 938.618659][T28615] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:55 executing program 4: syz_emit_ethernet(0x7e, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv4={0x800, @gre={{0xb, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0x14, 0x5, 0x1, 0x0, [{@multicast1}, {@loopback}]}, @timestamp={0x7, 0x4}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0) [ 938.843363][T28726] overlayfs: missing 'lowerdir' [ 938.854550][ T26] audit: type=1804 audit(1582811215.150:421): pid=28732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1441/bus" dev="sda1" ino=16860 res=1 13:46:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 939.065596][ T26] audit: type=1804 audit(1582811215.210:422): pid=28732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1441/bus" dev="sda1" ino=16860 res=1 13:46:55 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:46:55 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:55 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b"], 0xf5) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 939.319855][T28755] overlayfs: missing 'lowerdir' 13:46:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 939.681362][T28764] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 939.690336][T28764] FAT-fs (loop1): Filesystem has been set read-only [ 939.698740][T28764] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:56 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 939.720621][ T26] audit: type=1800 audit(1582811216.020:423): pid=28732 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16860 res=0 13:46:56 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}]) [ 939.907159][T28774] overlayfs: missing 'lowerdir' [ 940.068143][ T26] audit: type=1804 audit(1582811216.370:424): pid=28782 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1442/bus" dev="sda1" ino=16863 res=1 [ 940.098798][T28747] FAT-fs (loop4): bogus number of reserved sectors [ 940.123382][T28747] FAT-fs (loop4): Can't find a valid FAT filesystem 13:46:56 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, 0x0) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:56 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:46:56 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b"], 0xf5) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 940.465918][T28895] overlayfs: missing 'lowerdir' 13:46:57 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:57 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 940.804458][T28909] overlayfs: missing 'lowerdir' [ 941.045795][T28905] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 941.054895][T28905] FAT-fs (loop1): Filesystem has been set read-only [ 941.062827][T28905] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:57 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}]) 13:46:57 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:46:57 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:57 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b"], 0xf5) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 941.639672][T28937] overlayfs: missing 'lowerdir' 13:46:58 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 942.023448][T28974] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 942.032530][T28974] FAT-fs (loop1): Filesystem has been set read-only [ 942.040119][T28974] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:46:58 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) [ 942.200686][ T26] kauditd_printk_skb: 4 callbacks suppressed [ 942.200704][ T26] audit: type=1800 audit(1582811218.500:429): pid=28930 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16863 res=0 [ 942.250653][T29051] overlayfs: missing 'lowerdir' 13:46:58 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:46:58 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x6, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}]) 13:46:58 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:46:58 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 942.577832][ T26] audit: type=1804 audit(1582811218.880:430): pid=29167 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1444/bus" dev="sda1" ino=16858 res=1 [ 942.643981][ T26] audit: type=1804 audit(1582811218.900:431): pid=29167 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1444/bus" dev="sda1" ino=16858 res=1 13:46:59 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(0xffffffffffffffff, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 942.778695][T29248] overlayfs: missing 'lowerdir' 13:46:59 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:46:59 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 943.235447][T29293] overlayfs: missing 'lowerdir' 13:46:59 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 943.405971][ T26] audit: type=1800 audit(1582811219.700:432): pid=29167 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16858 res=0 13:46:59 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0}]) 13:47:00 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 943.734196][ T26] audit: type=1804 audit(1582811220.030:433): pid=29307 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1445/bus" dev="sda1" ino=16533 res=1 [ 943.797412][T29310] overlayfs: missing 'lowerdir' [ 943.849693][ T26] audit: type=1804 audit(1582811220.110:434): pid=29311 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1445/bus" dev="sda1" ino=16533 res=1 13:47:00 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(0xffffffffffffffff, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:47:00 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:47:00 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', 0x0, 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:00 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) [ 944.388683][T29325] overlayfs: missing 'lowerdir' [ 944.624593][ T26] audit: type=1800 audit(1582811220.920:435): pid=29311 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16533 res=0 13:47:01 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:01 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0}]) [ 944.898692][ T26] audit: type=1804 audit(1582811221.200:436): pid=29340 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1446/bus" dev="sda1" ino=16801 res=1 [ 944.968075][T29344] overlayfs: missing 'lowerdir' [ 944.974073][ T26] audit: type=1804 audit(1582811221.270:437): pid=29345 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir076109643/syzkaller.unFgJb/1446/bus" dev="sda1" ino=16801 res=1 13:47:01 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:01 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:47:01 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(0xffffffffffffffff, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 945.351170][T29355] FAT-fs (loop5): bogus number of reserved sectors [ 945.357823][T29355] FAT-fs (loop5): Can't find a valid FAT filesystem [ 945.377373][T29357] overlayfs: missing 'lowerdir' 13:47:01 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) [ 945.698031][ T26] audit: type=1800 audit(1582811222.000:438): pid=29345 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.2" name="bus" dev="sda1" ino=16801 res=0 13:47:02 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:02 executing program 2: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r1 = open(&(0x7f0000000440)='./bus\x00', 0x0, 0x0) ftruncate(r0, 0x2008001) dup3(r1, r0, 0x0) fcntl$setstatus(r0, 0x4, 0x44000) io_setup(0x4, &(0x7f0000000240)=0x0) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000002000)='./bus\x00', 0x143042, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0}]) [ 945.951190][T29373] overlayfs: missing 'lowerdir' 13:47:02 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:02 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 946.239580][T29385] FAT-fs (loop5): bogus number of reserved sectors [ 946.246192][T29385] FAT-fs (loop5): Can't find a valid FAT filesystem [ 946.382580][T29370] FAT-fs (loop4): bogus number of reserved sectors [ 946.389354][T29393] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 946.401831][T29393] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 13:47:02 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, 0xffffffffffffffff, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 946.443875][T29370] FAT-fs (loop4): Can't find a valid FAT filesystem 13:47:02 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:03 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB]) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:03 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x0, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:03 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @rand_addr="ff3e6808e92b7abafc47d822996f60e4"}, 0x1c) socketpair$unix(0x1, 0x8000000000005, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = dup3(r2, r1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0}}], 0xc6, 0x7ffffff7) [ 947.088517][T29405] overlayfs: missing 'lowerdir' 13:47:03 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 947.246300][T29415] FAT-fs (loop5): bogus number of reserved sectors [ 947.252893][T29415] FAT-fs (loop5): Can't find a valid FAT filesystem [ 947.478257][T29420] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 947.487378][T29420] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 13:47:03 executing program 2: syz_emit_ethernet(0x8e, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv4={0x800, @gre={{0xf, 0x4, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0x24, 0x18, 0x1, 0x0, [{@multicast1}, {@loopback}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@broadcast}]}, @timestamp={0x3, 0x2, 0x0, 0x2}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0) 13:47:04 executing program 2: syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xffc00000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="0400000000eeffff656174000404090a0200027400f801", 0x17}], 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fmask=0']) [ 947.765133][T29410] FAT-fs (loop4): bogus number of reserved sectors 13:47:04 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, 0xffffffffffffffff, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 947.817556][T29410] FAT-fs (loop4): Can't find a valid FAT filesystem 13:47:04 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:04 executing program 4: perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) [ 948.108525][T29443] FAT-fs (loop5): bogus number of reserved sectors [ 948.115119][T29443] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:04 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:04 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:47:04 executing program 4: perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:04 executing program 2: syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xffc00000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="0400000000eeffff656174000404090a0200027400f801", 0x17}], 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fmask=0']) [ 948.801775][T29658] overlayfs: option "workdir=." is useless in a non-upper mount, ignore 13:47:05 executing program 4: perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:05 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 948.935358][T29663] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 948.955806][T29658] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 948.978902][T29663] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 13:47:05 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r5, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r5, 0xffffffffffffffff, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:47:05 executing program 2: syz_emit_ethernet(0x8e, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv4={0x800, @gre={{0xf, 0x4, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0x24, 0x18, 0x1, 0x0, [{@multicast1}, {@loopback}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@broadcast}]}, @timestamp={0x7, 0x4, 0x5}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0) 13:47:05 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) [ 949.134058][T29780] FAT-fs (loop5): bogus number of reserved sectors [ 949.140760][T29780] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:05 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:05 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:47:05 executing program 2: syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xffc00000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="0400000000000080656174000404090a0200027400f801", 0x17}], 0x0, &(0x7f00000000c0)={[{@fat=@discard='discard'}]}) 13:47:06 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 949.712562][T29905] FAT-fs (loop2): mounting with "discard" option, but the device does not support discard [ 949.769023][T29974] overlayfs: unrecognized mount option "upper" or missing value 13:47:06 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:06 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x0, 0x0, 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:06 executing program 2: [ 949.910126][T30013] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 949.963087][T30013] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 950.015035][T30023] FAT-fs (loop5): bogus number of reserved sectors [ 950.021731][T30023] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:06 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0x0) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:47:06 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:06 executing program 2: 13:47:06 executing program 2: syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr, @local}, @parameter_prob={0x3, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev}}}}}}, 0x0) 13:47:06 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:47:07 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000000), 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:07 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=.']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 950.826348][T30145] overlayfs: unrecognized mount option "upper" or missing value 13:47:07 executing program 2: io_setup(0x7, &(0x7f0000000280)) [ 950.954783][T30152] FAT-fs (loop5): bogus number of reserved sectors [ 950.961386][T30152] FAT-fs (loop5): Can't find a valid FAT filesystem [ 950.979258][T30154] overlayfs: option "workdir=." is useless in a non-upper mount, ignore [ 951.017311][T30154] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent 13:47:07 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0x0) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:47:07 executing program 2: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002100)={0x0, 0x0, 0x0}, 0x0) clone(0x4000000000003fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readv(r0, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) ioctl$PPPIOCGIDLE(0xffffffffffffffff, 0x8008743f, 0x0) [ 951.309072][T30139] FAT-fs (loop4): bogus number of reserved sectors [ 951.324010][T30139] FAT-fs (loop4): Can't find a valid FAT filesystem 13:47:07 executing program 2: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000002100)={0x0, 0x0, 0x0}, 0x0) clone(0x4000000000003fe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readv(r0, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) ioctl$PPPIOCGIDLE(0xffffffffffffffff, 0x8008743f, 0x0) 13:47:07 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:07 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x8000000) r0 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc088cf2, 0x0, 0x0) read$char_usb(r0, 0x0, 0x0) 13:47:08 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000000), 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 951.857047][T30184] FAT-fs (loop5): bogus number of reserved sectors [ 951.863607][T30184] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:08 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:08 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:47:08 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x800000000000012, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x8000000) r0 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc088cf2, 0x0, 0x0) read$char_usb(r0, 0x0, 0x0) [ 952.304651][T30197] overlayfs: unrecognized mount option "upper" or missing value [ 952.331355][T30195] overlayfs: unrecognized mount option "upper" or missing value 13:47:08 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0x0) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:47:08 executing program 2: 13:47:09 executing program 2: 13:47:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x0, &(0x7f0000000000), 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:09 executing program 2: [ 952.912135][T30219] FAT-fs (loop5): bogus number of reserved sectors [ 952.920203][T30219] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:09 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:09 executing program 2: 13:47:09 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:47:09 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:09 executing program 2: 13:47:09 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(0x0, 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 953.569753][T30234] overlayfs: workdir and upperdir must be separate subtrees 13:47:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{0x0}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) [ 953.692687][T30236] overlayfs: unrecognized mount option "upper" or missing value 13:47:10 executing program 2: 13:47:10 executing program 2: [ 953.834840][T30248] FAT-fs (loop5): bogus number of reserved sectors [ 953.841477][T30248] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:10 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{0x0}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:10 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upper']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:10 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 954.622732][T30252] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 954.631461][T30252] FAT-fs (loop1): Filesystem has been set read-only [ 954.638285][T30252] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 954.718335][T30261] FAT-fs (loop5): bogus number of reserved sectors [ 954.724911][T30261] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:11 executing program 2: 13:47:11 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:11 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(0x0, 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 954.875326][T30268] overlayfs: unrecognized mount option "upper" or missing value [ 955.009869][T30270] overlayfs: workdir and upperdir must be separate subtrees 13:47:11 executing program 2: 13:47:11 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{0x0}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:11 executing program 2: 13:47:12 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:12 executing program 2: [ 955.896445][T30296] FAT-fs (loop5): bogus number of reserved sectors [ 955.903001][T30296] FAT-fs (loop5): Can't find a valid FAT filesystem [ 955.935720][T30286] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) 13:47:12 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 955.944755][T30286] FAT-fs (loop1): Filesystem has been set read-only [ 955.952408][T30286] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:47:12 executing program 2: [ 956.063427][T30302] overlayfs: workdir and upperdir must be separate subtrees 13:47:12 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:12 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(0x0, 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 956.265112][T30309] overlayfs: workdir and upperdir must be separate subtrees 13:47:12 executing program 2: 13:47:12 executing program 2: 13:47:12 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:12 executing program 2: 13:47:13 executing program 2: 13:47:13 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 957.086549][T30331] FAT-fs (loop5): bogus number of reserved sectors [ 957.093131][T30331] FAT-fs (loop5): Can't find a valid FAT filesystem [ 957.099158][T30320] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 957.109128][T30320] FAT-fs (loop1): Filesystem has been set read-only [ 957.116702][T30320] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:47:13 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 13:47:13 executing program 2: 13:47:13 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 957.309132][T30339] overlayfs: workdir and upperdir must be separate subtrees 13:47:13 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x0, 0x8000000000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:13 executing program 2: [ 957.476025][T30348] overlayfs: failed to resolve './fil': -2 13:47:14 executing program 2: 13:47:14 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:14 executing program 2: [ 958.135979][T30356] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 958.146174][T30356] FAT-fs (loop1): Filesystem has been set read-only [ 958.153878][T30356] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) [ 958.169901][T30369] FAT-fs (loop5): bogus number of reserved sectors [ 958.176511][T30369] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:14 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:14 executing program 2: 13:47:14 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 958.321563][T30376] overlayfs: workdir and upperdir must be separate subtrees 13:47:14 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) 13:47:14 executing program 2: 13:47:14 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) [ 958.612968][T30382] overlayfs: failed to resolve './fil': -2 13:47:15 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:15 executing program 2: 13:47:15 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) [ 959.317344][T30403] FAT-fs (loop5): bogus number of reserved sectors [ 959.323903][T30403] FAT-fs (loop5): Can't find a valid FAT filesystem [ 959.394800][T30388] FAT-fs (loop4): bogus number of reserved sectors 13:47:15 executing program 2: [ 959.457472][T30388] FAT-fs (loop4): Can't find a valid FAT filesystem [ 959.484504][T30394] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 959.493602][T30394] FAT-fs (loop1): Filesystem has been set read-only [ 959.501080][T30394] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:47:15 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 959.528546][T30408] overlayfs: failed to resolve './fil': -2 13:47:16 executing program 2: 13:47:16 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x3, 0x300) [ 959.705780][T30416] overlayfs: failed to resolve './fil': -2 13:47:16 executing program 2: 13:47:16 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:16 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:16 executing program 2: [ 960.141982][T30438] FAT-fs (loop5): bogus number of reserved sectors [ 960.148619][T30438] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:17 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:17 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 960.830932][T30433] FAT-fs (loop1): error, fat_get_cluster: invalid cluster chain (i_pos 17) [ 960.839836][T30433] FAT-fs (loop1): Filesystem has been set read-only [ 960.846568][T30433] FAT-fs (loop1): error, fat_free: invalid cluster chain (i_pos 17) 13:47:17 executing program 2: 13:47:17 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:17 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x0, 0x300) [ 960.988392][T30448] overlayfs: failed to resolve './fil': -2 [ 961.033556][T30449] overlayfs: failed to resolve './file': -2 13:47:17 executing program 4: clone(0x102, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0x0, 0x4000, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0xfffffffffffffd41, 0x6}], 0x0, 0x0) 13:47:17 executing program 2: [ 961.138633][T30459] FAT-fs (loop5): bogus number of reserved sectors [ 961.145195][T30459] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:18 executing program 2: 13:47:18 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r4 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r4, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r4, r3, 0x0, 0xa198) 13:47:18 executing program 0: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./fil']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) 13:47:18 executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x8, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000000)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000200)='./file0\x00', 0x100, 0x2) fchdir(r4) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'ip6_vti0\x00', 0x2000}) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETSW2(r4, 0x402c542c, 0x0) r5 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r6 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r6, &(0x7f0000000580)=ANY=[@ANYBLOB="000ffff0802bc8369ce73cb6fda400006224541f3780351157b252dd000000009154262a80420801444dd89f6bfd1510066a2128e6c04f112558c8bdac2ae91c22768a299a879ca5ea45ea6189f14f84644589436f645a783aac81cf5bc374f0ac00ef2728cfd3b16ae8a4ec80ebea0a7e8c20a5986a2ab75b34dc27b332714d36cba3ac62ec7100c22eb5d6638b8e1d01468ad3328280706dfc31700ea3fe507bfd0f8169b2187e8d804978b5a6397a1f471a29369349f8dcda480be4b38fb6862fc91512ff53f74ccb2674157b224da1961bbaf18cfe6f399d07607fc5fab1de1c96f9a0ec12a49084ae3bd0285c9cf65f5cd66b53"], 0x1e) sendfile(r6, r5, 0x0, 0xa198) ioctl$FS_IOC_SETVERSION(0xffffffffffffffff, 0x40087602, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) socket$key(0xf, 0x3, 0x2) socket$packet(0x11, 0x0, 0x300) 13:47:18 executing program 3: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000180)='./bus\x00', 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file']) chdir(&(0x7f00000002c0)='./bus\x00') unshare(0x20020000) mount$fuse(0x0, &(0x7f0000000040)='.\x00', 0x0, 0x0, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000040), &(0x7f0000000140)='./file0\x00', 0x0, 0x201000, 0x0) chdir(&(0x7f0000000000)='./file0\x00') pivot_root(&(0x7f00000004c0)='.\x00', &(0x7f0000000200)='./file0\x00') poll(0x0, 0x0, 0x400007f) rmdir(&(0x7f00000000c0)='./file0\x00') r0 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) r1 = inotify_init1(0x0) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./bus\x00', &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L+', 0x9}, 0x16, 0x0) r2 = dup(r1) inotify_add_watch(r2, &(0x7f0000000540)='./file0\x00', 0x9000018d) r3 = open(&(0x7f0000000040)='./file0\x00', 0x141042, 0x0) sendfile(r3, r0, 0x0, 0xa198) openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) name_to_handle_at(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) [ 962.045063][T30479] overlayfs: failed to resolve './fil': -2 [ 962.129395][T30484] FAT-fs (loop5): bogus number of reserved sectors [ 962.136129][T30484] FAT-fs (loop5): Can't find a valid FAT filesystem 13:47:18 executing program 2: clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000c80)=@raw={'raw\x00', 0x2, 0x3, 0x2c0, 0x0, 0x0, 0x228, 0x0, 0x0, 0x228, 0x228, 0x228, 0x228, 0x228, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@connmark={{0x30, 'connmark\x00'}}, @common=@unspec=@statistic={{0x38, 'statistic\x00'}, {0x0, 0x2}}]}, @common=@unspec=@AUDIT={0x28, 'AUDIT\x00'}}, {{@uncond, 0x0, 0xc0, 0x128, 0x0, {}, [@common=@icmp={{0x28, 'icmp\x00'}, {0x0, "a982"}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x320) r1 = memfd_create(&(0x7f0000000100)='wlan1\x00', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x5, 0x11, r1, 0x0) rt_sigaction(0x7, &(0x7f0000b4a000)={0xfffffffffffffffd, 0x4000005, 0x0}, 0x0, 0x8, &(0x7f0000000000)) syz_open_procfs(0x0, &(0x7f0000000040)='auxv\x00') prctl$PR_SET_DUMPABLE(0x4, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)='net/ip_tables_targets\x00') [ 962.352712][T30493] overlayfs: failed to resolve './file': -2 13:47:18 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x20, 0x1, 0x8, 0x401, 0x0, 0x0, {}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}}, 0x0) [ 962.702951][T30500] ================================================================== [ 962.711095][T30500] BUG: KCSAN: data-race in copyout / fat_time_unix2fat [ 962.717935][T30500] [ 962.720269][T30500] write to 0xffff88810ff43236 of 2 bytes by task 30497 on cpu 0: [ 962.727988][T30500] fat_time_unix2fat+0x156/0x2c0 [ 962.732928][T30500] __fat_write_inode+0x37d/0x510 [ 962.737866][T30500] fat_write_inode+0x67/0xe0 [ 962.742460][T30500] __writeback_single_inode+0x722/0x910 [ 962.748006][T30500] writeback_single_inode+0x219/0x2f0 [ 962.753387][T30500] sync_inode_metadata+0x75/0xa0 [ 962.758324][T30500] __generic_file_fsync+0x117/0x180 [ 962.763526][T30500] fat_file_fsync+0x54/0x120 [ 962.768116][T30500] vfs_fsync_range+0x7c/0x150 [ 962.772787][T30500] generic_file_write_iter+0x31c/0x38e [ 962.778231][T30500] do_iter_readv_writev+0x4a7/0x5d0 [ 962.783419][T30500] do_iter_write+0x137/0x3a0 [ 962.788003][T30500] vfs_iter_write+0x56/0x80 [ 962.792532][T30500] iter_file_splice_write+0x530/0x830 [ 962.797916][T30500] direct_splice_actor+0x97/0xb0 [ 962.802994][T30500] splice_direct_to_actor+0x22f/0x540 [ 962.808348][T30500] do_splice_direct+0x152/0x1d0 [ 962.813182][T30500] do_sendfile+0x396/0x810 [ 962.817587][T30500] __x64_sys_sendfile64+0x121/0x140 [ 962.822857][T30500] do_syscall_64+0xc7/0x390 [ 962.827369][T30500] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 962.833246][T30500] [ 962.835560][T30500] read to 0xffff88810ff43000 of 1024 bytes by task 30500 on cpu 1: [ 962.843430][T30500] copyout+0x9b/0xb0 [ 962.847315][T30500] copy_page_to_iter+0x25c/0x910 [ 962.852248][T30500] generic_file_read_iter+0x96a/0x1490 [ 962.857691][T30500] blkdev_read_iter+0xae/0xe0 [ 962.862361][T30500] new_sync_read+0x306/0x450 [ 962.866954][T30500] __vfs_read+0x9e/0xb0 [ 962.871109][T30500] vfs_read+0x13e/0x2b0 [ 962.875261][T30500] ksys_read+0xc5/0x1a0 [ 962.879410][T30500] __x64_sys_read+0x49/0x60 [ 962.883912][T30500] do_syscall_64+0xc7/0x390 [ 962.888415][T30500] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 962.894294][T30500] [ 962.896610][T30500] Reported by Kernel Concurrency Sanitizer on: [ 962.902773][T30500] CPU: 1 PID: 30500 Comm: blkid Not tainted 5.6.0-rc1-syzkaller #0 [ 962.910677][T30500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 962.920731][T30500] ================================================================== [ 962.928799][T30500] Kernel panic - not syncing: panic_on_warn set ... [ 962.935387][T30500] CPU: 1 PID: 30500 Comm: blkid Not tainted 5.6.0-rc1-syzkaller #0 [ 962.943280][T30500] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 962.953590][T30500] Call Trace: [ 962.956902][T30500] dump_stack+0x11d/0x187 [ 962.961246][T30500] panic+0x210/0x640 [ 962.965160][T30500] ? vprintk_func+0x89/0x13a [ 962.969760][T30500] kcsan_report.cold+0xc/0x14 [ 962.974451][T30500] kcsan_setup_watchpoint+0x304/0x400 [ 962.979825][T30500] copyout+0x9b/0xb0 [ 962.983726][T30500] copy_page_to_iter+0x25c/0x910 [ 962.988672][T30500] ? mark_page_accessed+0x148/0x4f0 [ 962.993876][T30500] generic_file_read_iter+0x96a/0x1490 [ 962.999366][T30500] blkdev_read_iter+0xae/0xe0 [ 963.004180][T30500] new_sync_read+0x306/0x450 [ 963.008793][T30500] __vfs_read+0x9e/0xb0 [ 963.012952][T30500] vfs_read+0x13e/0x2b0 [ 963.017110][T30500] ksys_read+0xc5/0x1a0 [ 963.021272][T30500] __x64_sys_read+0x49/0x60 [ 963.025779][T30500] do_syscall_64+0xc7/0x390 [ 963.030298][T30500] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 963.036192][T30500] RIP: 0033:0x7f399c4ef310 [ 963.040611][T30500] Code: 73 01 c3 48 8b 0d 28 4b 2b 00 31 d2 48 29 c2 64 89 11 48 83 c8 ff eb ea 90 90 83 3d e5 a2 2b 00 00 75 10 b8 00 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 6e 8a 01 00 48 89 04 24 [ 963.060223][T30500] RSP: 002b:00007ffe253f8db8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 963.068639][T30500] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f399c4ef310 [ 963.076611][T30500] RDX: 0000000000000400 RSI: 000000000229cb18 RDI: 0000000000000003 [ 963.084581][T30500] RBP: 000000000229caf0 R08: 0000000000000028 R09: 0000000001680000 [ 963.092547][T30500] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000229a030 [ 963.100517][T30500] R13: 0000000000000400 R14: 000000000229a080 R15: 000000000229cb08 [ 963.109515][T30500] Kernel Offset: disabled [ 963.113841][T30500] Rebooting in 86400 seconds..