Warning: Permanently added '10.128.1.57' (ECDSA) to the list of known hosts. 2020/03/03 20:27:19 fuzzer started [ 135.816795][ T33] audit: type=1400 audit(1583267239.879:42): avc: denied { map } for pid=11396 comm="syz-fuzzer" path="/root/syz-fuzzer" dev="sda1" ino=2339 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 2020/03/03 20:27:25 dialing manager at 10.128.0.26:34713 2020/03/03 20:27:25 syscalls: 2967 2020/03/03 20:27:25 code coverage: enabled 2020/03/03 20:27:25 comparison tracing: CONFIG_KCOV_ENABLE_COMPARISONS is not enabled 2020/03/03 20:27:25 extra coverage: enabled 2020/03/03 20:27:25 setuid sandbox: enabled 2020/03/03 20:27:25 namespace sandbox: enabled 2020/03/03 20:27:25 Android sandbox: /sys/fs/selinux/policy does not exist 2020/03/03 20:27:25 fault injection: enabled 2020/03/03 20:27:25 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2020/03/03 20:27:25 net packet injection: enabled 2020/03/03 20:27:25 net device setup: enabled 2020/03/03 20:27:25 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 2020/03/03 20:27:25 devlink PCI setup: PCI device 0000:00:10.0 is not available [ 141.395032][ T33] audit: type=1400 audit(1583267245.459:43): avc: denied { integrity } for pid=11413 comm="syz-executor" lockdown_reason="debugfs access" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=lockdown permissive=1 20:30:33 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r1, &(0x7f0000001a40)=[{{0x0, 0x0, &(0x7f00000001c0)}, 0x100}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/mcfilter\x00') preadv(r4, &(0x7f0000000480), 0x10000000000002a1, 0x0) bpf$MAP_CREATE(0x3100000000000000, 0x0, 0x0) mount$bpf(0x20000000, 0x0, 0x0, 0x0, 0x0) pivot_root(0x0, 0x0) socket$packet(0x11, 0x0, 0x300) [ 329.643685][ T33] audit: type=1400 audit(1583267433.709:44): avc: denied { map } for pid=11414 comm="syz-executor.0" path="/sys/kernel/debug/kcov" dev="debugfs" ino=17431 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=1 [ 330.052274][T11415] IPVS: ftp: loaded support on port[0] = 21 [ 330.264848][T11415] chnl_net:caif_netlink_parms(): no params data found [ 330.416043][T11415] bridge0: port 1(bridge_slave_0) entered blocking state [ 330.424067][T11415] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.433488][T11415] device bridge_slave_0 entered promiscuous mode [ 330.449023][T11415] bridge0: port 2(bridge_slave_1) entered blocking state [ 330.456324][T11415] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.465674][T11415] device bridge_slave_1 entered promiscuous mode [ 330.514163][T11415] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 330.533689][T11415] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 330.582337][T11415] team0: Port device team_slave_0 added [ 330.597995][T11415] team0: Port device team_slave_1 added [ 330.641687][T11415] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 330.649054][T11415] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 330.675737][T11415] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 330.694462][T11415] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 330.701554][T11415] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 330.728238][T11415] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 330.918806][T11415] device hsr_slave_0 entered promiscuous mode [ 331.072744][T11415] device hsr_slave_1 entered promiscuous mode [ 331.569264][ T33] audit: type=1400 audit(1583267435.629:45): avc: denied { create } for pid=11415 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 331.576211][T11415] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 331.594813][ T33] audit: type=1400 audit(1583267435.629:46): avc: denied { write } for pid=11415 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 331.626932][ T33] audit: type=1400 audit(1583267435.629:47): avc: denied { read } for pid=11415 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 331.683648][T11415] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 331.832714][T11415] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 332.043145][T11415] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 332.458673][T11415] 8021q: adding VLAN 0 to HW filter on device bond0 [ 332.496196][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 332.505522][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 332.530063][T11415] 8021q: adding VLAN 0 to HW filter on device team0 [ 332.554676][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 332.565876][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 332.575246][ T2770] bridge0: port 1(bridge_slave_0) entered blocking state [ 332.582633][ T2770] bridge0: port 1(bridge_slave_0) entered forwarding state [ 332.623090][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 332.632702][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 332.642504][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 332.651869][ T2770] bridge0: port 2(bridge_slave_1) entered blocking state [ 332.659074][ T2770] bridge0: port 2(bridge_slave_1) entered forwarding state [ 332.668061][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 332.705917][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 332.723749][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 332.733882][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 332.764325][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 332.774030][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 332.783641][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 332.823451][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 332.833198][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 332.842883][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 332.852907][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 332.865560][T11415] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 332.928447][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 332.936370][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 332.973008][T11415] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 333.045055][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 333.055130][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 333.118961][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 333.128807][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 333.155693][T11415] device veth0_vlan entered promiscuous mode [ 333.166638][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 333.176027][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 333.219935][T11415] device veth1_vlan entered promiscuous mode [ 333.302664][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 333.313213][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 333.322678][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 333.332758][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 333.357230][T11415] device veth0_macvtap entered promiscuous mode [ 333.381536][T11415] device veth1_macvtap entered promiscuous mode [ 333.393600][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 333.403116][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 333.467391][T11415] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 333.475981][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 333.485907][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 333.511521][T11415] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 333.520379][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 333.532060][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 333.987731][ T33] audit: type=1400 audit(1583267438.049:48): avc: denied { associate } for pid=11415 comm="syz-executor.0" name="syz0" scontext=unconfined_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1 [ 334.369212][ T33] audit: type=1400 audit(1583267438.429:49): avc: denied { map_create } for pid=11441 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 20:30:38 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002a00000084000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00'}, 0x48) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) dup2(r1, r0) 20:30:39 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, 0x0, r2, 0x0, 0x4a, 0x0) ioctl$int_in(r2, 0x541b, &(0x7f0000000100)) write$P9_RWSTAT(r1, &(0x7f00000000c0)={0x7}, 0x7) [ 335.360854][T11449] IPVS: ftp: loaded support on port[0] = 21 20:30:39 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=0xc) setresuid(0x0, 0x0, 0xee00) setresuid(0x0, 0x0, r2) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 335.618418][T11449] chnl_net:caif_netlink_parms(): no params data found 20:30:39 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=0xc) setresuid(0x0, 0x0, 0xee00) setresuid(0x0, 0x0, r2) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 335.838734][T11449] bridge0: port 1(bridge_slave_0) entered blocking state [ 335.846462][T11449] bridge0: port 1(bridge_slave_0) entered disabled state [ 335.856434][T11449] device bridge_slave_0 entered promiscuous mode [ 335.881590][T11449] bridge0: port 2(bridge_slave_1) entered blocking state [ 335.888992][T11449] bridge0: port 2(bridge_slave_1) entered disabled state [ 335.898789][T11449] device bridge_slave_1 entered promiscuous mode [ 335.982005][T11449] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 336.031471][T11449] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link 20:30:40 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=0xc) setresuid(0x0, 0x0, 0xee00) setresuid(0x0, 0x0, r2) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 336.123396][T11449] team0: Port device team_slave_0 added [ 336.158636][T11449] team0: Port device team_slave_1 added 20:30:40 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=0xc) setresuid(0x0, 0x0, 0xee00) setresuid(0x0, 0x0, r2) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 336.232807][T11449] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 336.239881][T11449] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 336.266052][T11449] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 336.338801][T11449] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 336.346019][T11449] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 336.372290][T11449] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active 20:30:40 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 336.559685][T11449] device hsr_slave_0 entered promiscuous mode [ 336.583988][T11449] device hsr_slave_1 entered promiscuous mode [ 336.622157][T11449] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 336.629798][T11449] Cannot create hsr debugfs directory 20:30:40 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 336.981612][T11449] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 337.039208][T11449] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 337.131712][T11449] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 337.194593][T11449] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 337.554554][T11449] 8021q: adding VLAN 0 to HW filter on device bond0 [ 337.594395][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 337.603860][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 337.628400][T11449] 8021q: adding VLAN 0 to HW filter on device team0 [ 337.659883][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 337.670827][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 337.680246][ T2770] bridge0: port 1(bridge_slave_0) entered blocking state [ 337.687506][ T2770] bridge0: port 1(bridge_slave_0) entered forwarding state [ 337.732769][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 337.742402][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 337.752264][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 337.761589][ T2770] bridge0: port 2(bridge_slave_1) entered blocking state [ 337.768959][ T2770] bridge0: port 2(bridge_slave_1) entered forwarding state 20:30:41 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 337.778070][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 337.829574][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 337.875161][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 337.885562][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 337.933387][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 337.943624][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 337.954331][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 337.973956][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 337.983908][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 338.022137][T11449] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 338.035230][T11449] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 338.044246][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 338.055604][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 338.116540][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 338.124358][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 338.162413][T11449] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 338.231226][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 338.241518][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 338.310072][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 338.319937][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 338.344595][T11449] device veth0_vlan entered promiscuous mode [ 338.355278][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 338.364560][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 338.403143][T11449] device veth1_vlan entered promiscuous mode [ 338.489292][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 338.499119][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 338.508363][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 338.518084][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 338.541208][T11449] device veth0_macvtap entered promiscuous mode [ 338.564167][T11449] device veth1_macvtap entered promiscuous mode [ 338.623604][T11449] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 338.634192][T11449] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 338.647734][T11449] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 338.659503][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 338.669121][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 338.678414][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 338.688322][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready 20:30:42 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000080)=0xc) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 338.728509][T11449] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 338.739546][T11449] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 338.752950][T11449] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 338.772154][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 338.781265][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 339.548924][ T33] audit: type=1400 audit(1583267443.609:50): avc: denied { open } for pid=11503 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 [ 339.573192][ T33] audit: type=1400 audit(1583267443.609:51): avc: denied { kernel } for pid=11503 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 [ 339.597141][ T33] audit: type=1400 audit(1583267443.609:52): avc: denied { confidentiality } for pid=11503 comm="syz-executor.1" lockdown_reason="unsafe use of perf" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=lockdown permissive=1 20:30:43 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 339.702062][ T33] audit: type=1400 audit(1583267443.699:53): avc: denied { prog_load } for pid=11503 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 [ 339.760971][ T33] audit: type=1400 audit(1583267443.819:54): avc: denied { prog_run } for pid=11503 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=bpf permissive=1 20:30:44 executing program 1: mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='l']) mlockall(0x7) munlockall() 20:30:44 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:44 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:44 executing program 1: syz_open_procfs(0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r1, &(0x7f0000001a40)=[{{0x0, 0x0, &(0x7f00000001c0)}, 0x100}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x1) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/mcfilter\x00') preadv(r4, &(0x7f0000000480), 0x10000000000002a1, 0x2f) sendmsg$NFNL_MSG_ACCT_NEW(r4, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x74, 0x0, 0x7, 0x101, 0x0, 0x0, {0x5, 0x0, 0x2}, [@NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0xfffffffffffffffb}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0xd74f}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x3}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x71d0}, @NFACCT_FILTER={0xc, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x8}]}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x6}]}, 0x74}}, 0x8010) bpf$MAP_CREATE(0x3100000000000000, &(0x7f0000000080)={0x6, 0x4, 0x20000000007ffd, 0x31, 0x0, 0xffffffffffffffff, 0x0, [0x31, 0x5f, 0xc1, 0xc1, 0x2, 0xc]}, 0x3c) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) pivot_root(&(0x7f0000000180)='./file0\x00', 0x0) socket$packet(0x11, 0x0, 0x300) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$FUSE_INTERRUPT(r5, &(0x7f0000000080)={0x10}, 0x10) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7fffff, 0x40000000011, r5, 0x0) socket$packet(0x11, 0x0, 0x300) 20:30:44 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:44 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 340.890672][T11530] fuse: Bad value for 'fd' 20:30:45 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 341.059181][T11533] fuse: Bad value for 'fd' 20:30:45 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 341.216147][T11536] fuse: Bad value for 'fd' 20:30:45 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:45 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:45 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10414, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x300cce, &(0x7f0000000080)={@local, @empty, @val, {@ipv6}}, 0x0) 20:30:45 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 341.630092][ T33] audit: type=1400 audit(1583267445.689:55): avc: denied { map } for pid=11544 comm="syz-executor.1" path="/dev/nullb0" dev="devtmpfs" ino=440 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=blk_file permissive=1 [ 341.692951][ C0] hrtimer: interrupt took 62195 ns 20:30:45 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:46 executing program 0: mkdir(0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:46 executing program 1: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10414, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x300cce, &(0x7f0000000080)={@local, @empty, @val, {@ipv6}}, 0x0) 20:30:46 executing program 0: mkdir(0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:46 executing program 0: mkdir(0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:46 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) ioctl$TCGETS2(r0, 0x802c542a, &(0x7f00000002c0)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000000000000000000000000000000000000000000000000000000000000020000000300000058020000f80000000000000000000000f800000000000000c4010000c4010000c4010000c4010000c40100000300000000000000e0000001ac1414aa000000000000000073797a6b616c6c6572300000000000006e65747063693000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d800f8000000000000000000000000000000000000000000680072617465657374000000000000000000000000000000000000000000000076657468305f746f5f6272696467650076657468315f746f5f687372000000001d0002000000000000000000000000000000000000000000000000000000000000000000000000002000545241434500000000000000000000000000000000000000000000000000ac1e000100000000000000000000000067656e657665300000000000000000006272696467655f736c6176655f300000000000000000000000000000000000000000000000000000000000000000000000000000000000007000cc0000000000000000000000000000000000000000005c00434c5553544552495000000000000000000000000000000000000000000000000000aaaaaaaaaa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000940000000000000000000000000000000000000000002400000000000000000000000000000000000000000000000000000000000000feffffff"], 0x2b4) 20:30:46 executing program 1: syz_emit_ethernet(0x52, &(0x7f00000000c0)={@multicast, @broadcast, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "dc9ae7", 0x18, 0x3a, 0x0, @local, @mcast2, {[], @mld={0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr="904f4b7890fd9e828be0762d0d2a3fb4"}}}}}}, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000080)) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) sendto$inet(r0, &(0x7f0000000140)="0610d868bb29fa50723fc87d73f33ad996fbef5b806f2190bdd4b30ae77dc8f2e85da6ed368fdceed2e14e0dad50e5a1f868bf00421d32eeedc9abd9c24c98eb8ac7112e2cd454be82f97f", 0x4b, 0x40000d1, &(0x7f0000000040)={0x2, 0x4e26, @local}, 0x10) 20:30:46 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:47 executing program 1: setsockopt$inet_sctp_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f0000000000)=0x3fc6, 0x4) set_mempolicy(0x4003, &(0x7f0000000040)=0x5, 0x2) pipe(&(0x7f00000001c0)) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) splice(r0, 0x0, r1, 0x0, 0x20000038, 0x8) [ 343.063931][T11579] fuse: Bad value for 'fd' 20:30:47 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'syz_tun\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x3d2}}, 0x0) getsockname$packet(r5, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="340000001000010400"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000140012000c00010062726964676500000002008a43b671b25f62fc1d9531ddad0400000000000000df2845fba0b719d3e5a89d7530b5e8cd7d3c0f2f5f2292bad7c458ee21076715aa9db03d0b509839efd05753e809b64736b9892dcf58a6d295f4418f8fd9ca97ade88fc88b2b74127501559a776f286a5e52a6764b2775f4f5ef0139fd1c2de78c6675d3e9ffff96058f22ea7d47f351fd0b0467f67e312c5d0f25becdcf639ef8bb621a7dc74525a6a24e5f907918d41c0f409d284c08c818c741341c088fab76c178f9bb9883c56416f011f1d127339092e7b416ee6fbc455aa16954844c891f5546ec71bbfd906c120e5890d6e480f0bf6472988ccb9f82c5a686e37628ae3ff399dcc27d0bbe6b0a5f21b30ccc4de2ed5fc40da07e4e0d9fe9dcca33602844fdebdb043cc06751d92d030e8deef8bc90180cee8abd2979bb5ad56aac43c96602792b408ff73c3c1af42f2e075fdf0c6b6ed8454f69d687f41128b80000010065c7dd494b0520dc17eb650f2e52acbf26f15d29c20d762b8f559b4f3b750180000096583d06c6b6545086739eb9b9a16690ba990591949090b356487e587c00000000"], 0x34}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="28a0d6137800011400003f350000002000000000e6664ae7e3214bc9030afb08b7dc3def4869e0b8224a79d8026c18a1dea8a051", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB="34254bea4b7aaf5db725ab7d6eff5d44b900efb7bcd15a4366be4b115f8544b6d9d16180ebed"], 0x28}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newlink={0x20, 0x11, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r6}}, 0x20}}, 0x0) [ 343.280549][T11585] fuse: Bad value for 'fd' 20:30:47 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 343.535137][T11590] fuse: Bad value for 'fd' 20:30:47 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 343.573476][T11591] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 343.592476][T11591] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=120 sclass=netlink_route_socket pid=11591 comm=syz-executor.1 20:30:47 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:48 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 344.046396][T11591] bridge0: port 1(bridge_slave_0) entered disabled state 20:30:48 executing program 2: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7, 0x101200) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0086426, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x0}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r0, 0xc008641d, &(0x7f0000000100)={r1, &(0x7f00000000c0)=""/25}) ioctl$DRM_IOCTL_CONTROL(0xffffffffffffffff, 0x40086414, &(0x7f0000000140)={0x0, 0x85}) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000180)={0xf, 0x1f, 0x2, 0x6}, 0xf) r2 = fcntl$dupfd(0xffffffffffffffff, 0xc0a, 0xffffffffffffffff) ioctl$SNDRV_PCM_IOCTL_STATUS32(r2, 0x806c4120, &(0x7f00000001c0)) setsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000240)=@int=0x511d, 0x4) r3 = openat$cgroup_ro(r2, &(0x7f0000000280)='cpu.stat\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=0xffffffffffff8001, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x3, 0x1}, 0x0, 0x0, &(0x7f0000000340)={0x1, 0x9, 0x34, 0x3ff}, &(0x7f0000000380)=0xf38, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=0x8}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000500)={r4}, 0xc) ioctl$DRM_IOCTL_MAP_BUFS(r2, 0xc00c6419, &(0x7f0000000800)={0x3, &(0x7f0000000540)=""/76, &(0x7f00000007c0)=[{0x5, 0xba, 0x80000001, &(0x7f00000005c0)=""/186}, {0x5, 0xaa, 0x2, &(0x7f0000000680)=""/170}, {0x100, 0x74, 0xffffffff, &(0x7f0000000740)=""/116}]}) r5 = syz_open_procfs(0x0, &(0x7f0000000840)='net/sockstat\x00') sendmsg$IPSET_CMD_SAVE(r5, &(0x7f0000000980)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x64, 0x8, 0x6, 0x101, 0x0, 0x0, {0xf, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x810) getsockopt$IP_SET_OP_VERSION(0xffffffffffffffff, 0x1, 0x53, &(0x7f00000009c0), &(0x7f0000000a00)=0x8) sendmsg$IPSET_CMD_SAVE(r3, &(0x7f0000000b40)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000a80)={0x58, 0x8, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) r6 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000b80)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$EVIOCSREP(r6, 0x40084503, &(0x7f0000000bc0)=[0x3ff, 0x7]) r7 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000c40)={&(0x7f0000000c00)='./file0\x00'}, 0x10) fsetxattr$trusted_overlay_opaque(r7, &(0x7f0000000c80)='trusted.overlay.opaque\x00', &(0x7f0000000cc0)='y\x00', 0x2, 0x1) r8 = dup3(r5, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x9, 0x100010, r8, 0x10000000) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000d00)={0x0, 0x4}, &(0x7f0000000d40)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000d80)={r9, 0x3}, 0x8) getsockopt$SO_COOKIE(r8, 0x1, 0x39, &(0x7f0000000dc0), &(0x7f0000000e00)=0x8) clock_gettime(0x0, &(0x7f0000004680)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000004580)=[{{&(0x7f0000000e40)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000001480)=[{&(0x7f0000000ec0)=""/187, 0xbb}, {&(0x7f0000000f80)=""/242, 0xf2}, {&(0x7f0000001080)=""/253, 0xfd}, {&(0x7f0000001180)=""/216, 0xd8}, {&(0x7f0000001280)=""/76, 0x4c}, {&(0x7f0000001300)=""/224, 0xe0}, {&(0x7f0000001400)=""/125, 0x7d}], 0x7, &(0x7f00000014c0)=""/210, 0xd2}, 0x8}, {{&(0x7f00000015c0)=@nfc_llcp, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001640)=""/158, 0x9e}, {&(0x7f0000001700)=""/69, 0x45}, {&(0x7f0000001780)=""/22, 0x16}], 0x3, &(0x7f0000001800)=""/239, 0xef}, 0x5}, {{0x0, 0x0, &(0x7f0000001c40)=[{&(0x7f0000001900)=""/40, 0x28}, {&(0x7f0000001940)=""/176, 0xb0}, {&(0x7f0000001a00)=""/174, 0xae}, {&(0x7f0000001ac0)=""/117, 0x75}, {&(0x7f0000001b40)=""/112, 0x70}, {&(0x7f0000001bc0)=""/69, 0x45}], 0x6, &(0x7f0000001c80)=""/180, 0xb4}, 0xb2b}, {{&(0x7f0000001d40)=@in={0x2, 0x0, @remote}, 0x80, &(0x7f0000001f00)=[{&(0x7f0000001dc0)=""/36, 0x24}, {&(0x7f0000001e00)=""/217, 0xd9}], 0x2, &(0x7f0000001f40)=""/4096, 0x1000}, 0x8}, {{&(0x7f0000002f40), 0x80, &(0x7f0000004140)=[{&(0x7f0000002fc0)=""/4096, 0x1000}, {&(0x7f0000003fc0)=""/220, 0xdc}, {&(0x7f00000040c0)=""/56, 0x38}, {&(0x7f0000004100)=""/62, 0x3e}], 0x4, &(0x7f0000004180)=""/145, 0x91}, 0x7}, {{0x0, 0x0, &(0x7f0000004300)=[{&(0x7f0000004240)=""/191, 0xbf}], 0x1, &(0x7f0000004340)=""/58, 0x3a}, 0x7fffffff}, {{0x0, 0x0, &(0x7f0000004440)=[{&(0x7f0000004380)=""/57, 0x39}, {&(0x7f00000043c0)=""/94, 0x5e}], 0x2, &(0x7f0000004480)=""/193, 0xc1}, 0x7}], 0x7, 0x40000120, &(0x7f00000046c0)={r10, r11+30000000}) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r12, 0x84, 0x1f, &(0x7f0000004700)={r9, @in6={{0xa, 0x4e24, 0xfffffff9, @ipv4={[], [], @multicast2}, 0x3}}, 0x0, 0x6}, 0x88) r13 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000047c0)='/dev/video37\x00', 0x2, 0x0) ioctl(r13, 0x101, &(0x7f0000004800)="9653b2c6dd9e9b8519065b1d042305f50429b30e42b437faf0470a0e321108d328f76d") 20:30:48 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 344.200297][T11591] device bridge_slave_0 left promiscuous mode [ 344.206717][T11591] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.403656][T11606] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 344.423720][T11591] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=120 sclass=netlink_route_socket pid=11591 comm=syz-executor.1 20:30:48 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:48 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = getpid() prlimit64(r1, 0x0, 0x0, &(0x7f0000000180)) tkill(r1, 0x2c) clock_settime(0x3, &(0x7f0000000300)={0x0, 0x1c9c380}) prlimit64(0x0, 0x0, 0x0, &(0x7f0000000180)) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r2, 0x0, 0x9, &(0x7f0000000180)='selfproc\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000240)={r3}, 0xc) ioctl$TIOCL_BLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000200)) r4 = socket$kcm(0xa, 0x0, 0x0) r5 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x10001, 0x80000) ioctl$USBDEVFS_RESETEP(r5, 0x80045503, &(0x7f0000000080)={0xa}) prctl$PR_SET_PDEATHSIG(0x1, 0xc) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) getsockopt$SO_TIMESTAMP(r5, 0x1, 0x23, &(0x7f0000000100), &(0x7f0000000140)=0x4) r6 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r6, 0x8983, &(0x7f0000000380)={0x3, 'syzkaller0\x00', {0xfffffff9}, 0xffff}) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) r9 = socket$inet(0x2, 0x2, 0x85) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r8, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, r10}, 0x20) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f0000000280)={r10, 0x8, 0xb8ae}, &(0x7f00000002c0)=0x8) setsockopt$inet6_int(r5, 0x29, 0x24, &(0x7f00000000c0)=0x3, 0x4) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, &(0x7f0000000340)={0x0, 'ipvlan0\x00', {0x4}, 0x8}) ioctl$USBDEVFS_CONTROL(r2, 0xc0105500, &(0x7f00000003c0)={0x60, 0x0, 0xc43, 0xfffe, 0x0, 0x101, &(0x7f0000000380)}) 20:30:48 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 344.922928][ T33] audit: type=1400 audit(1583267448.989:56): avc: denied { getrlimit } for pid=11613 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=process permissive=1 20:30:49 executing program 1: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000001440)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x2200cf7d, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r0, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000180)="b851", 0x2}], 0x1}, 0x140000c9) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000400)=""/4087, 0xff7}, {&(0x7f0000000080)=""/84, 0x54}, {}], 0x3}, 0x0) r1 = dup2(r0, r0) read$dsp(r1, &(0x7f0000002400)=""/4096, 0x1000) [ 345.084265][T11616] IPVS: ftp: loaded support on port[0] = 21 20:30:49 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, 0x0) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:49 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, 0x0) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 345.401228][T11616] chnl_net:caif_netlink_parms(): no params data found 20:30:49 executing program 1: r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/load\x00', 0x2, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000140)={0xffffffff, 0x67}) write$selinux_load(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e75781500000000f601000800000007000000402c110000000000090000070081ffff0300000000000000385a5800000000000000000001000000000100056067667d8c4bb2cf5b587f9f908625190f5280d5d21159f2635040071c59c28f42195dd110e8106ac4c476d1d35414e2c6ba462e0c3cce2f12d1bae15c2fc2be0f"], 0x4b) [ 345.655023][T11635] SELinux: failed to load policy 20:30:49 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, 0x0) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 345.699099][T11616] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.706506][T11616] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.715913][T11616] device bridge_slave_0 entered promiscuous mode 20:30:49 executing program 1: sched_setattr(0x0, 0x0, 0x0) syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r0 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0x0, 0x4, 0x3}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)={0x2, 0x3, 0x0, 0x3, 0x10, 0x0, 0x0, 0x0, [@sadb_sa={0x2, 0x1, 0x4d4, 0x0, 0x3, 0xa6, 0x4, 0x20000001}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x4e20, @remote}}, @sadb_x_policy={0x8, 0x12, 0x0, 0x0, 0x0, 0x6e6bb5, 0x104, {0x6, 0x0, 0x1f, 0x8, 0x0, 0x1, 0x0, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@mcast2}}, @sadb_key={0x1}]}, 0x80}}, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000680)='maps\x00') setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000000140)=0x7, 0x4) preadv(r3, &(0x7f0000000140), 0x0, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, &(0x7f00000000c0)={'raw\x00', 0x3, [{}, {}, {}]}, 0x58) r4 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$nbd(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="3f4466980000000000000000000000006517a42ac4cb7a63d1a9bda75a31524e892eac4021b714a3202f99f16d06589e03469637a7267592938766e40935efd21affe2009efdc34d220cc5a5960ac203886dcdfbd5355459047b022d45136803a9e841e864010000bc7e87c10dfc8b2cf1fd84d6cd3e51a59d7ec760979dc57e82b694bf28352eb0cd570771ff9732e960199f7a411a8f3ef18d79705fae72269eebb18ae3bf47ad81d5894e03d6b1e80e6a23c2b6dedfaf85840d6210753676a23ed5be7b2ab9656d4d4e12a022c6597e0c444ad1bfd38e3b0a9d88"], 0x74) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$bt_l2cap(r5, &(0x7f00000000c0), 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, &(0x7f0000000480), 0x0) sendfile(r5, r4, &(0x7f0000000200), 0xa198) socket$nl_xfrm(0x10, 0x3, 0x6) syz_genetlink_get_family_id$batadv(&(0x7f0000000100)='batadv\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bridge_slave_0\x00'}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3400000010000104533cf7ed9300"/23, @ANYRES32=r9, @ANYBLOB="ddffffffffffffff140012000c0001006272696467650000040002004a8c1b6a238e3c4ad8aaf50c71a903efb4ed6f549d620cab62d981eb6d374923a2b1597449331902ca8bdf6a7b128fe8476d4d6652037756d0ac81399ac0582b151d141fe83ed1d9132ab02d67c1c5acd5789c4893db25c5630cca8a430aeff83d56f554ff14196fa347774c415acdeb046e3cf870dd52c26f6c603b8f3e34d021af63b3cfa8316e16c38ca72e58c356fde87643e8b809318f8d222ce63317ded42fa3aa394ade7dfe439c6479605528726a068cdc76a22067b3534442da88bc90000000000000000000000000f6a0d707"], 0x34}}, 0x0) [ 345.751009][T11616] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.758861][T11616] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.768320][T11616] device bridge_slave_1 entered promiscuous mode 20:30:50 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 345.932568][T11616] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 345.972091][T11616] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 346.065305][T11616] team0: Port device team_slave_0 added [ 346.120610][T11616] team0: Port device team_slave_1 added [ 346.167554][T11646] fuse: Bad value for 'fd' [ 346.178489][T11616] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 346.185682][T11616] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 346.211861][T11616] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 346.234934][T11616] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 346.242148][T11616] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 346.268272][T11616] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 346.438932][T11616] device hsr_slave_0 entered promiscuous mode [ 346.504497][T11616] device hsr_slave_1 entered promiscuous mode [ 346.552329][T11616] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 346.560067][T11616] Cannot create hsr debugfs directory [ 346.589261][T11644] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 346.886780][T11616] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 346.946043][T11616] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 346.999595][T11644] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 347.016852][T11616] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 347.074945][T11616] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 347.424691][T11616] 8021q: adding VLAN 0 to HW filter on device bond0 [ 347.466990][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 347.476342][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 347.503125][T11616] 8021q: adding VLAN 0 to HW filter on device team0 [ 347.529629][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 347.539510][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 347.550140][ T4127] bridge0: port 1(bridge_slave_0) entered blocking state [ 347.557435][ T4127] bridge0: port 1(bridge_slave_0) entered forwarding state [ 347.571730][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 347.590241][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 347.599738][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 347.608946][ T2770] bridge0: port 2(bridge_slave_1) entered blocking state [ 347.616310][ T2770] bridge0: port 2(bridge_slave_1) entered forwarding state [ 347.663590][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 347.673660][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 347.717891][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 347.728382][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 347.737855][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 347.747714][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 347.795804][T11616] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 347.806435][T11616] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 347.823011][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 347.832149][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 347.840970][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 347.850456][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 347.860033][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 347.913537][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 347.936784][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 347.945247][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 347.979994][T11616] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 348.056830][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 348.067056][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 348.141265][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 348.150956][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 348.166216][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 348.175302][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 348.198630][T11616] device veth0_vlan entered promiscuous mode [ 348.250401][T11616] device veth1_vlan entered promiscuous mode [ 348.336299][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 348.345789][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 348.355100][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 348.365085][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 348.390734][T11616] device veth0_macvtap entered promiscuous mode [ 348.428250][T11616] device veth1_macvtap entered promiscuous mode [ 348.486960][T11616] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 348.497989][T11616] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 348.508017][T11616] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 348.518548][T11616] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 348.532448][T11616] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 348.540297][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 348.549644][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 348.558969][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 348.568719][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 348.619859][T11616] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 348.630981][T11616] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 348.641499][T11616] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 348.652032][T11616] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 348.665456][T11616] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 348.676907][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 348.687008][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 20:30:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c00128009000100766c616e000000000c0002800600050000000000"], 0x3c}}, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1, 0x3ff}) 20:30:53 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:53 executing program 1: syz_mount_image$hfsplus(&(0x7f0000000140)='hfsplus\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={[{@nls={'nls', 0x3d, 'utf8'}, 0x3e}]}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={0x1, 0x28, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r0, 0x7fffffff, 0x8}, 0xc) [ 349.534962][T11684] fuse: Bad value for 'fd' 20:30:53 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 349.593632][T11681] hfsplus: unable to load nls mapping "utf8>" [ 349.599965][T11681] hfsplus: unable to parse mount options [ 349.649119][T11688] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=11688 comm=syz-executor.2 [ 349.669085][T11688] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=30255 sclass=netlink_route_socket pid=11688 comm=syz-executor.2 20:30:53 executing program 2: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f00000000c0)={@dev}, 0x20) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') preadv(r1, &(0x7f00000017c0), 0x3a8, 0x7a) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x48}}, 0x0) sendmsg$NL80211_CMD_GET_WIPHY(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r3, 0x800, 0x70bd25, 0x25dfdbfb, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x6c1, 0x3}}, @NL80211_ATTR_WDEV={0xc, 0x99, {0xffffffff, 0x3}}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x1) [ 349.784852][T11681] hfsplus: unable to load nls mapping "utf8>" [ 349.791145][T11681] hfsplus: unable to parse mount options [ 349.963034][T11697] fuse: Bad value for 'fd' 20:30:54 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000000)=0x101) setxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x2) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r2 = getpid() prlimit64(r2, 0x0, 0x0, &(0x7f0000000180)) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000280)) sendmsg$AUDIT_SET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x34, 0x3e9, 0x100, 0x70bd25, 0x25dfdbfd, {0x39, 0x1, 0x2, r2, 0x7, 0x4d1, 0xc0, 0x0, 0x81}, ["", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x8894}, 0x4000814) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) ioctl$sock_SIOCDELDLCI(r4, 0x8981, &(0x7f0000000240)={'veth0_virt_wifi\x00', 0x4}) 20:30:54 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 350.291647][T11708] fuse: Invalid rootmode 20:30:54 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 350.331056][T11701] netlink: 'syz-executor.2': attribute type 5 has an invalid length. 20:30:54 executing program 1: socketpair(0x1f, 0x3, 0x3, &(0x7f0000000000)) socket$kcm(0x11, 0xf, 0x300) syz_emit_ethernet(0x26, &(0x7f0000000140)={@random, @multicast, @val={@void}, {@arp={0x806, @generic={0x0, 0x0, 0x6, 0x0, 0x0, @link_local, "", @dev={[], 0x17}}}}}, 0x0) [ 350.526894][T11712] netlink: 'syz-executor.2': attribute type 5 has an invalid length. [ 350.551364][T11716] fuse: Invalid rootmode 20:30:54 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:54 executing program 2: r0 = socket$inet(0x2, 0x2, 0x6) bind$inet(r0, &(0x7f00000003c0)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000000440)=[{&(0x7f00000002c0)="0a99b3e3930870dcd4c6d68e6abe088af4ccdbe6dc85ed63bcee4834cd53f8a19cfad53574230c17377bd7b3eb23d9008f0c69b08db538753bcf550f05d219f8c6ca03228dd8d293261ba079190f47d70c95a97fe5d4cb7511e180f73e8ef5e2f7ee4f47c1a036e37e87414e615396eeb9", 0x71}, {&(0x7f0000000840)="b5252522629f34a16eef84ce1b0063a44d2793e337dc2c6bb2d88107b89a1516610f2003d59c73b5c7e008a287d2a1d473414b1adeb4ca87742298b064ae974e919c8052517580479968", 0x4a}], 0x2) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) write$binfmt_script(r0, &(0x7f0000000980)=ANY=[@ANYBLOB="23ff1f0a8117fb6ad5eb1b3c750c75c5533f018823a16997c30a069cb5b742686128af8baad097514187691d92010000009e3db9f1ab586e0a9ce86db57e1d384bfe3042c49ef9134937af481f2b44e023b3884e0efb76d2659a715f3b513e33fd0000000aff7f00000003000000000832ff0769dea9ed32487d2bf1ac37e8b368d4ef58c744b7657622ece02a12061817b9b9afcf98d817857774006e59839dcf8ae7619cef4f4608d60900cc6227080000ebffffffffff80f6ffbe89000097559772f645e9898fb9d669af77550098329a0aa58aa500aa06421df57fdb00008661b7149be1214dca2ecda1b75ef43828915ae534ec23f3b30f369465e898c48d5d2ca0ed88aeb86674ced74e3f66ef99868d120001c8f4ce0200000000f67db2194f66a7220000005c88aea53f83a9e6ccbbc71b4b7714882ba48ad4148fae0dfa9fc7584c7f62fff70f0fde2ee3d352d62120d17149b07d5e423279353cf796779627f1f70fd32a8f7b04f425666ee94a7fa8fe2047204fc308cdd34a11d0aeed8481e8014c6c000ae8e63aa94915eb425e982a63c310bf9245b086842415ce76461c2cafb0f9f7cd48e0ecb7a6167d6aa3c292c55fc0d13c251c7137621fcc9d42b107a0a219c64cd50354473518e6af403d2d658569043e4bfc780983cc40521b5383500a62302e742038656e583df49e6023d26a1273eb2400f1fece8755e904c408c4f7ec6f612164b56a409f0721685753f2626c82bbfb74886c0a2a4ca1375808dcf83fee229044b2665e11b305ad6473985deffa65d182865b2059ff9c4fd6f6fe51100101c42bef43e7972c0650a839937695ae6616680873dc47171ed8f84d2eafbc7ba5cadc8d5f1a6b7fd3e35d0098c186e304418d4c7fcb9d9f8b56233fb373ba2956fde5bd7b1a1bd9a2d1d429b9954e472d0cb9b66aefddfb7aec86729ba8a20c8b9dea31b6e5841763aa90906178ddea0100"/708], 0x2c4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000140), 0x4) sendto$inet(r0, &(0x7f00000012c0)="1e268a927f1f6588b967481241ba7860005cf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b087511bf746bec66ba", 0x4d, 0x20008005, 0x0, 0x0) 20:30:54 executing program 1: syz_mount_image$gfs2(&(0x7f0000000000)='gfs2\x00', &(0x7f0000000040)='./file0\x00', 0xfffffffd, 0x0, 0x0, 0x0, &(0x7f0000000080)={[{@meta='meta'}, {@quota='quota'}, {@barrier='barrier'}, {@statfs_quantum={'statfs_quantum', 0x3d, 0x1}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0xff, 0x4, 0x3, "2a7d462a3331d929826303045489bc463c95075d2e4860b2f6f2ab71075fc477", 0x30385056}) [ 350.836792][T11724] fuse: Invalid rootmode 20:30:55 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(0x0, 0x0, 0x0) [ 351.024672][T11728] gfs2: not a GFS2 filesystem [ 351.112879][T11728] gfs2: not a GFS2 filesystem 20:30:55 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000100)='./file0\x00', 0x5, 0x0, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYRES16, @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYRESDEC, @ANYRESDEC, @ANYRES64=r0, @ANYRESDEC, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYPTR64], @ANYRESOCT=r1]]]) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x828) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$KVM_SET_TSS_ADDR(r2, 0xae47, 0xd000) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) ioctl$VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc044565d, &(0x7f00000001c0)={0x6, 0x2, 0x4, 0x800, 0xc5, {}, {0x2, 0xc, 0x1f, 0x5, 0x1f, 0x7, "7caa345f"}, 0xfffffff7, 0x3, @fd=r1, 0xffffff60, 0x0, r3}) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r4, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x48, 0x1411, 0x300, 0x70bd26, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x3b}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x5}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x28}]}, 0x48}, 0x1, 0x0, 0x0, 0x40880}, 0x800) 20:30:55 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000240)=@dstopts, 0x8) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000000)=@routing, 0x8) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000100)=@fragment={0x5e, 0x0, 0x1, 0x1, 0x0, 0x4, 0x66}, 0x8) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self\x00', 0x101140, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TCSETAW(r2, 0x5407, &(0x7f00000000c0)={0xfc00, 0x5, 0x101, 0x47da, 0x8, "f774ff47647cea36"}) listen(r0, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa9b30c6c31e178100000086dd6000004000140600fe8000000000000000000000000006aafe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50c2ddff90780000"], 0x0) 20:30:55 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(0x0, 0x0, 0x0) [ 351.500094][T11748] xfs: Unknown parameter '€' 20:30:55 executing program 2: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000040)=0x5ba09f51) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000100)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x3) read$FUSE(r0, &(0x7f0000000380), 0x1000) socket$caif_seqpacket(0x25, 0x5, 0x4) 20:30:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) ioctl$SIOCX25GSUBSCRIP(r3, 0x89e0, &(0x7f0000000340)={'ip6tnl0\x00', 0x200, 0x1}) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x9) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x2a9, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="000000000000000028001200090001007665746800000000180002001400010000000000", @ANYRES32=0x0, @ANYBLOB="0000b20000000000"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x40, 0x10, 0xffffff0f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8, 0x1, 'hsr\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r5}, @IFLA_HSR_SLAVE2={0x8, 0x2, r1}]}}}]}, 0x40}}, 0x0) 20:30:55 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(0x0, 0x0, 0x0) [ 351.950095][T11766] device macvtap0 entered promiscuous mode [ 351.956987][T11766] device macvtap0 left promiscuous mode 20:30:56 executing program 2: syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185647, &(0x7f0000000180)={0x9c0000, 0x1, 0x1f, 0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x990a5f, 0x8001, [], @p_u32=&(0x7f0000000100)=0x4}}) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f00000001c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}) 20:30:56 executing program 0 (fault-call:4 fault-nth:0): mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 352.188898][T11766] device macvtap0 entered promiscuous mode [ 352.195861][T11766] device macvtap0 left promiscuous mode 20:30:56 executing program 2: syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/seq/clients\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185647, &(0x7f0000000180)={0x9c0000, 0x1, 0x1f, 0xffffffffffffffff, 0x0, &(0x7f0000000140)={0x990a5f, 0x8001, [], @p_u32=&(0x7f0000000100)=0x4}}) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f00000001c0)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}) [ 352.328882][T11772] device macvtap0 entered promiscuous mode [ 352.335849][T11772] device macvtap0 left promiscuous mode [ 352.407371][T11779] FAULT_INJECTION: forcing a failure. [ 352.407371][T11779] name failslab, interval 1, probability 0, space 0, times 1 [ 352.421251][T11779] CPU: 1 PID: 11779 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0 [ 352.430000][T11779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 352.440111][T11779] Call Trace: [ 352.443490][T11779] dump_stack+0x1c9/0x220 [ 352.447924][T11779] should_fail+0x8b7/0x9e0 [ 352.452454][T11779] __should_failslab+0x1f6/0x290 [ 352.457446][T11779] should_failslab+0x29/0x70 [ 352.462078][T11779] kmem_cache_alloc+0xd0/0xd70 [ 352.466883][T11779] ? getname_flags+0x12e/0xb00 [ 352.471706][T11779] ? kmsan_get_metadata+0x11d/0x180 [ 352.476955][T11779] getname_flags+0x12e/0xb00 [ 352.481604][T11779] ? kmsan_internal_set_origin+0x75/0xb0 [ 352.487286][T11779] user_path_at_empty+0xbb/0x140 [ 352.492283][T11779] do_fchownat+0x174/0x420 [ 352.496772][T11779] __ia32_sys_lchown16+0x173/0x1c0 [ 352.501949][T11779] ? __se_sys_lchown16+0x150/0x150 [ 352.507103][T11779] do_fast_syscall_32+0x3c7/0x6e0 [ 352.512203][T11779] entry_SYSENTER_compat+0x68/0x77 [ 352.517349][T11779] RIP: 0023:0xf7f5fd99 [ 352.521465][T11779] Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 352.541108][T11779] RSP: 002b:00000000f5d5a0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000010 [ 352.549562][T11779] RAX: ffffffffffffffda RBX: 0000000020000140 RCX: 0000000000000000 [ 352.557567][T11779] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 352.565566][T11779] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 352.573566][T11779] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 352.581568][T11779] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 20:30:56 executing program 0 (fault-call:4 fault-nth:1): mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:56 executing program 1: openat$vfio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vfio/vfio\x00', 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x80, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) connect$tipc(r1, &(0x7f0000000080)=@id={0x1e, 0x3, 0x1, {0x4e23, 0x4}}, 0x10) r2 = getpid() syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x5, 0x2) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) ioctl$SNDCTL_DSP_GETIPTR(r4, 0x800c5011, &(0x7f00000001c0)) prlimit64(r2, 0x0, 0x0, &(0x7f0000000180)) write$FUSE_LK(r0, &(0x7f0000000040)={0x28, 0x0, 0x6, {{0x1000, 0x401, 0x0, r2}}}, 0x28) 20:30:57 executing program 2: set_mempolicy(0x4003, &(0x7f0000000140)=0x101, 0x2) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000200)='\x00', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) r0 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, r0) clone(0x4412c500, 0x0, 0x0, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) ioctl$VIDIOC_QUERYBUF(r1, 0xc0445609, &(0x7f0000000180)={0x1, 0x3, 0x4, 0x4, 0x5, {r2, r3/1000+10000}, {0x2, 0xc, 0x20, 0x81, 0x1f, 0x0, "74235304"}, 0x8, 0x4, @fd, 0x2, 0x0, r4}) getsockopt$bt_hci(r5, 0x0, 0x1, &(0x7f0000000240)=""/97, &(0x7f0000000080)=0x61) 20:30:57 executing program 0: mkdir(&(0x7f0000000280)='./file0\x00', 0x1a2) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:30:57 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x61, 0x10, 0x28}, [@ldst={0x7}]}, &(0x7f0000003ff6)='GPL\x00', 0x0, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x4, 0x10, &(0x7f0000000000), 0x4}, 0x14) prctl$PR_GET_THP_DISABLE(0x2a) r0 = dup(0xffffffffffffffff) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f00000001c0)={0x1, 0x10000, 0xd35, 0x9, 0x4}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000140)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0], 0x8, 0x3, 0x4}) openat(r1, &(0x7f0000000200)='./file0\x00', 0x202800, 0xb) [ 353.254571][T11795] IPVS: ftp: loaded support on port[0] = 21 [ 353.407217][T11802] IPVS: ftp: loaded support on port[0] = 21 20:30:57 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) keyctl$session_to_parent(0x12) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x1420000a77, 0x4) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x240740, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r5, 0x0, 0x0}, 0x20) ioctl$SG_GET_SG_TABLESIZE(r5, 0x227f, &(0x7f0000000140)) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x149100, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = pidfd_getfd(r7, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r8, 0x84, 0x4, &(0x7f00000000c0), &(0x7f0000000100)=0x4) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYRES64=r10], 0x1}, 0x1, 0x0, 0x0, 0x44000}, 0x4000000) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffffd88) 20:30:57 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000340), 0x0) r1 = syz_open_dev$vcsu(&(0x7f0000000080)='/dev/vcsu#\x00', 0x2, 0x0) ioctl$TCSETSW2(r1, 0x402c542c, &(0x7f00000000c0)={0x0, 0x0, 0x5, 0x7ff, 0x41, "48b53524f7c108fff990e5bda54033a4b1caa1", 0x4, 0x7}) ftruncate(r0, 0x800799c) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000380)={0x0, 0xff, 0x1, 0xfff, 0x9, [{0xdf76, 0x10001, 0x6, [], 0x800}, {0x7ff, 0x5, 0x400, [], 0x1083}, {0xffffffffffff241a, 0x3, 0xb0, [], 0xc01}, {0x0, 0xffffffff, 0x7, [], 0x400}, {0x1, 0x20, 0x8, [], 0xa81}, {0x9, 0x92b, 0x4, [], 0x306}, {0xc8, 0x2, 0x3, [], 0xa08}, {0x8, 0x84a7, 0x6, [], 0x881}, {0x2, 0x9, 0x7ff, [], 0x1}]}) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xa601, 0x2012, r0, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(0xffffffffffffffff, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(0xffffffffffffffff, 0x4, &(0x7f0000000000)='/em1\xda\x00', &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5}, 0x20) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) r7 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000240)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r6, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r7, 0x8, 0x70bd25, 0x25dfdbfe, {}, [@SEG6_ATTR_DSTLEN={0x8, 0x2, 0x70}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x4}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x7}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x7c}, @SEG6_ATTR_ALGID={0x5, 0x6, 0xc1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x80000000}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x9}]}, 0x4c}, 0x1, 0x0, 0x0, 0x10}, 0x4884) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000140)={r5, 0x3c, &(0x7f0000000100)=[@in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e21, @remote}, @in6={0xa, 0x4e20, 0x5, @remote, 0x2}]}, &(0x7f0000000180)=0xc) [ 353.810331][ T33] audit: type=1400 audit(1583267457.869:57): avc: denied { map } for pid=11810 comm="syz-executor.1" path=2F6D656D66643A202864656C6574656429 dev="tmpfs" ino=32076 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=file permissive=1 20:30:58 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="1b04"]) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 354.436173][T11815] fuse: Bad value for 'group_id' 20:30:58 executing program 2: set_mempolicy(0x8003, &(0x7f0000000300)=0x75f, 0x9) r0 = socket$inet(0x2, 0x800, 0x1) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000100)=0xc6, 0x4) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) write$P9_RLOPEN(r2, &(0x7f0000000180)={0x18, 0xd, 0x1, {{0x4, 0x0, 0x2}, 0x3}}, 0x18) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) socket$bt_bnep(0x1f, 0x3, 0x4) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000080), &(0x7f00000000c0)=0xc) write$FUSE_WRITE(r1, &(0x7f0000000140)={0x18, 0xfffffffffffffff5, 0x5, {0x9}}, 0x18) [ 354.469470][T11816] fuse: Bad value for 'group_id' 20:30:58 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="091263d7d98e9b992b3d60ba87b72d3f2f3940f0253e119745ccf8f95f7aff274b8c438a91ddcf33d725b232c82001d8bf09c5cf46e01301f4b0c739b2909b838aa9448b1f51e6527c56ded77abc67247871dd0271f397918191"]) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x440000, 0x0) write$cgroup_int(r1, &(0x7f0000000080)=0x1, 0x12) r2 = socket$inet_dccp(0x2, 0x6, 0x0) statx(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x1000, 0x80, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$ext4(&(0x7f0000000180)='ext3\x00', &(0x7f00000001c0)='./file0\x00', 0x101, 0x1, &(0x7f0000000400)=[{&(0x7f0000000300)="dbf6b4da6b6999c671b33fc1c72b46cc1354cad4ad1a7d440cac8505d501c651149d760ce256275e3008f9e4f85c49d3e9f646199ea08cc53730e2b62c2250274dc9a2b14ab28f632807ff8cdddfaa631330eaf06020ac3b8dccc81389f48b17be49d4c7a950aa350a034ed4ae6c95a8b30282ded034c91b120e7e0e742b804e94a835b7a453f1bcc308a227fde7e94b0a7bbac4d7428237522e81993776ba234c28a6bd1b9992728ec42f63ad54f1658fb3804a35c1a506a1ddc976480313076a59cbc22d7a90dda79e418df8cf69c3a83d9e1078eafd45085581e08a3525c9671d0b97a29358a8", 0xe8, 0x6}], 0x2000000, &(0x7f0000000680)={[{@max_batch_time={'max_batch_time', 0x3d, 0x401}}, {@errors_continue='errors=continue'}], [{@obj_type={'obj_type', 0x3d, ',.GPL\xc0'}}, {@obj_user={'obj_user', 0x3d, '/dev/fuse\x00'}}, {@dont_measure='dont_measure'}, {@uid_lt={'uid<', r3}}]}) ioctl$sock_netdev_private(r2, 0x89fe, &(0x7f0000000240)="4a7c2b3675616a3a01912fd6158b9838ef2cdafab24dea0954f5546b381eb4e41e3c74aeef52d0717210c96a82ea2831342c58d3236a5462ea0b21f4085ef8987dbd58285914b0c4e35827d29ec7542422a4196b21bfc0d3523404e2759a521bf6c508811573d098fa75c81672be977fc4cb8336d8aeb88f542b4cc3376032a289c9d2c6dadbd5c6a64b15b8c1") [ 354.860577][T11825] fuse: Bad value for 'group_id' [ 354.912499][T11825] EXT4-fs (loop0): VFS: Can't find ext4 filesystem 20:30:59 executing program 2: syz_mount_image$hfs(&(0x7f0000000180)='hfs\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="636f3d69736fa8d7235dd000013835392d372c696f636861727365743d64656661756c74414e930864a225720b4b09a52c00"]) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) statx(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r0, 0x400454ce, r1) [ 355.193349][T11825] fuse: Bad value for 'group_id' [ 355.235435][T11832] EXT4-fs (loop0): VFS: Can't find ext4 filesystem [ 355.325994][T11843] hfs: unable to parse mount options [ 355.462928][T11843] hfs: unable to parse mount options 20:30:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x2, 0x40) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r2) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5}, 0x20) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000180)={0x7, 0x820e, 0x4, 0x9, r5}, &(0x7f00000001c0)=0x10) setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x0) r6 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9, 0x1, 'bond\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5}]}}}]}, 0x3c}}, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r8, 0x0, 0x0}, 0x20) r9 = dup3(r8, 0xffffffffffffffff, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)={0x50, r11, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}]}]}, 0x50}, 0x1, 0x300}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r9, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000000340)={0xd4, r11, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x73c1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffffe}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x22, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x800}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}]}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_hsr\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x68}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3f}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20000011}, 0x40000) [ 355.841210][T11857] bond0: option ad_select: unable to set because the bond device is up 20:31:00 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f00000000c0)=0x5, 0x251) sendmsg$inet6(r0, &(0x7f0000001840)={&(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c, 0x0, 0x53, &(0x7f0000000000)=ANY=[@ANYBLOB="2c00000029000000360000003b0200000000000005020f13c910ff020000000000000000000000000001000014bb28d8e06decce2656cfc8f4475f0fe157e350b92cf1808d0e67e54653b1f89f18704069a2fc8baee3b787592171d415a33d9d578bb7f6a063e8c5d46c386b3e2735f1ef24f06097e140f9ab1cdcdd125adff4b4a38bb6ac5547449122fe2293318d416882d6fa94"], 0x95}, 0x0) [ 355.953391][T11858] bond0: option ad_select: unable to set because the bond device is up 20:31:00 executing program 2: socket$inet6(0x10, 0x3, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000000)) sendto$inet6(r0, &(0x7f0000000240)="270000002e0089e4dc560700280ff44ea6f2cb20ffffffff00000000846c293c86625a8bcb862e529a16798f153b32ce9d3dfc1f2a41704173e92de496bc9f791acc6e1f58df8445c101623494473066a1823d7010f7685b0c21aa68ecb77ad1034ae8693b743341d5e59df2609abba4bb414b92cc94537707e9fd08db0e5bb0de3cb3022d63fe46d470662cbc1488b4e2bcd27d60fd1f6c33bc1b35b604d6a35253037c5093e73fdbef7c42cd24e33f2d5799f842f2e9e2843781943d46cffded1c336c52697fd1a19bf4ec3d30ab9fdefc29b526ea6ed4081148961e9b69b158d0d030f9b345cb8d0366c2491aa98379298f25fa30cab8c79a30ba5fc851d47fe8c0c7f12b3beea540e5b451bbc5f01b7a54c59c46bb003340c25442f89ebeae8e2f5d3c3e9356b58316faa3c91d228dd71d9850b8f186b6fa32aba037b95fbe6c632787171b717721c45b21d40c82a02f03b935c34566ffd4215d2bbe1a1298a767a8270e9ada87cd53df9c9f911626c56a1a1433b47db66e", 0x32, 0x4040040, 0x0, 0x14) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x101, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000140)=0x14) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000880)=ANY=[@ANYBLOB="8c0400001200000429bd7000fbdbdf25267f92034e214e220300000001000000f40a00000500000004000000080000000004000007000000", @ANYRES32=r2, @ANYBLOB="090000000001001a0600000020000000c30001004c5e9fe5320372e3d62c976c91cd335ca6d3085bb7fb62e0047e2c0aaec84701b01e103f85f18a53a80089b2deeea45d0252fff2e9b002136e861a995f9a311655a79eaa9b051bc26422327b4b09dd4468cb462a556f2668c6af9fe3f93f83dc387610640a7a7cc4aae79e5d789e11ce72edea1abe908ec2cdd6fb6eb201b59edfae03ef0fdfb416ef547c5f2351cae3f54fb7c8ab5b7942ce794753e6e8a74e64d02f25efcf1c20927e63d61ab26a25f1eedb9810951aedb949a30585004b00a0000100896e2cf47f410e87b794eed75a313ae539b14740c94116794fdcab0503dfdee29a80d075ca08ea498ce83b25a947ca60a8a648968705aa819cc62b1277c71883606a39271a4140dd1350b1b077998d8b73e9263592f187870c21f9f9ec8f088ff7beb622fc1ceab83cf7a43eefb166f4090885f7721eab40b50c3daeba4386a9e4e3adb4a6407a57cbfe599d6dc21021bdc976e4382eb41c7b0c977a94000100849384cab17ca1a72b044710eaebaa0b92ea6f51b82f9c0eefca917ed9cd2c5de1a16a176b5f5815e8535c64724e32cabcd479802d5de374d428bd7192a7e3bb8760730277df5ac6113d1f34bcea39a80075078dc673b5e3812a6dbb0b8b16bf35a7dc69d825cf69f1510d6718cb47dc9423bca4dd24cc591b736356c8e4815f6da0a065756c66103538dad09f9f536b45b426c8c0a9473b1d0fbdf7f52c89c5000100873d618621deee670a94cb085cdfae5bc07534b1ec8f19051c17a3ac38b3dca15f7f416419bb374ae67582bcab2d443a7dec3a6a03c71840c84eed555bedd701c368eda73dc156a67a5575e11d7a91e247cd533a0f760ac028ac369d20046b0a428b4ab73d53f41493a09fa27ba4c08150d8b26b8288c7a88c0a9502c08e797ac3a2584a158696dc76feb493742230a7d4fa1041ca84688acf40cc68bc037705916e6b8ff107ff7769f52edf06f4cb363b28dd9f6ee7c701cd4b8137ff57fcb76200000042000100fe9b3666fe53e7136505648483556e15877a9c1ad98c0ca34a1bdadb6d49a055fc7652176db838eaffc3b63f4f5b5fed00852c18e222c21a1519b168f7acce4d00001f0001002b421e831c2cad2e5062b9ee8481f74e15ac6165aea7f7919421aa0027000100ee463b94354d569c9554a071fc2eb54cfec1a6931628f13d49e1a9b3c099c4b75e463700f30001000722ff4dc2ebfde6c7fb2ea872dfca0127fa6b2a62d351de60e27e5af43cc251cadf67febad53293032ccca349d19ffa8b17be67422c921eaa47b57267e147fc7c7b9fe5fcf526b22063e6b411a8cb85502d4d6e7df472a8365b4303ea0cd8520229bc40dfda670ebb104643d2a209b01b11f19252df0502b1d39d5f8e3c4698396fe842f9e9c239cc95a173744ee7edee55a6fafc7af7240ea974f0c3c1a604c74ba91dd34131b8175da72a137818d17fa868e7a04396c591f474777a35cc02091fe77012c223b8099138ffadd79c0b6d450543b79f2b7e8587341899499efb94"], 0x48c}, 0x1, 0x0, 0x0, 0x24044000}, 0x4000) 20:31:00 executing program 1: unshare(0x40000000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000240)) ioctl$VIDIOC_QBUF(r0, 0xc044560f, &(0x7f0000000080)={0x4, 0xe, 0x4, 0x40, 0x2, {}, {0x4, 0x8, 0x5, 0x6, 0x0, 0xfc}, 0x8000, 0x1, @userptr=0x8, 0x80000000, 0x0, 0xffffffffffffffff}) setsockopt$inet_dccp_buf(r1, 0x21, 0xe, &(0x7f0000000100)="79003ad85cd08d1a3f75e333c68344b02e8966abfc9ed0eab437fe44a2dec43c41f345f8f5f1f960474ee2144dc6becf2bf0d2a008ab3367d9ece46f9003afb3368c3095fb15668b49e8249fb54637975ee651fedfed9fc8f156c5cc3f498146aac9fe38cba533cafd3a3843b63b4fe8b88e4a4ff85e8972988c41620a448782bd665ae2d32cd16f4dfa0935d0edece849f418fffae4a3b543ab89fea670abe413d3728ecbb0c27e7d7a8876acc9e6f13b2a95062c1861de13a1f5c2e97e81d6d7cc773be00fd8341505466519", 0xcd) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000200)={'bridge0\x00', {0x2, 0x4e23, @empty}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x8031, r0, 0xffffc000) socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x0, 0x1) close(r3) 20:31:00 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8982, &(0x7f00000000c0)={0x6, 'lo\x00', {0x2}, 0x9}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) syz_emit_ethernet(0x4, &(0x7f0000000ac0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60a22050000c2f00fe800000000000000000000000000000fe8000000000000000000000000000aa3c0088be", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1e095322f6f55add12a04402aab307", @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYPTR64, @ANYPTR64, @ANYPTR, @ANYPTR64], @ANYRESHEX, @ANYRES16=r0, @ANYRES32, @ANYRESHEX, @ANYRESDEC=0x0, @ANYRESHEX=0x0, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYPTR, @ANYRESOCT, @ANYPTR, @ANYRESOCT, @ANYRES32=0x0, @ANYRES64, @ANYBLOB="a9bb6d80a1241f9a62387435a4a3cfa29236189691fd28132a554744ee37e1352f66b24ce917c536f29660515a1efb317b37595b6db72828b52a7cceeeb121995b575a22c89835955063ec8c3c1f1494ce8287b25d28c98d3ff30c23f4dd5eb68267af905a7212e3caa3f1da881f0e30f62a7500f75c0cd1b0dfbb73fc0dfaccea3b86c4ea57be6c8fbf19dd15a40e3c074abf5f4abc8f7ac9a8245dff", @ANYRESOCT=r1, @ANYRES32=r3]]], 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0xc5) ioctl$sock_rose_SIOCRSCLRRT(r4, 0x89e4) [ 356.517641][T11871] IPVS: ftp: loaded support on port[0] = 21 20:31:00 executing program 3: setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000000)={@rand_addr=0xffffffff, @local, 0x1, 0x2, [@rand_addr=0x800, @local]}, 0x18) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x185300, 0x5) ioctl$USBDEVFS_GET_SPEED(r0, 0x551f) r1 = accept4$x25(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x12, 0x80000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000100)={'batadv0\x00'}) fanotify_mark(r0, 0x40, 0x0, r0, &(0x7f0000000140)='./file0\x00') setsockopt$CAN_RAW_JOIN_FILTERS(r0, 0x65, 0x6, &(0x7f0000000180), 0x4) r2 = socket$inet6(0xa, 0x3, 0x40) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f00000001c0)={0x0, 0x5}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000240)={r3, 0x3f, 0x7, 0x86bf}, 0x10) fgetxattr(r1, &(0x7f0000000280)=@known='trusted.overlay.origin\x00', &(0x7f00000002c0)=""/4096, 0x1000) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40047705, &(0x7f00000012c0)={0x8, 0x9}) r4 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000001300)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r4, 0x40045568, 0x30) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000001380)='batadv\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000002800)={{{@in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@local}}, &(0x7f0000002900)=0xe4) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000029c0)={&(0x7f0000001340), 0xc, &(0x7f0000002980)={&(0x7f0000002940)={0x34, r5, 0x2, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x401}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x7}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r6}]}, 0x34}}, 0x40000) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000002a00)='/proc/capi/capi20\x00', 0x214000, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000002b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000002b40)=0x14) setsockopt$inet_mreqn(r7, 0x0, 0x23, &(0x7f0000002b80)={@multicast2, @rand_addr=0x7, r8}, 0xc) connect$bt_sco(r4, &(0x7f0000002bc0), 0x8) r9 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000002c00)='/selinux/checkreqprot\x00', 0x800, 0x0) sendmsg$AUDIT_GET_FEATURE(r9, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x10, 0x3fb, 0x300, 0x70bd25, 0x25dfdbff, "", ["", "", "", ""]}, 0x10}}, 0x20000040) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc044560f, &(0x7f0000002d80)={0x80, 0x5, 0x4, 0x10, 0xd59, {0x0, 0x7530}, {0x2, 0xc, 0x2, 0x0, 0x6, 0xd4, "07df0872"}, 0x0, 0x4, @planes=&(0x7f0000002d40)={0x10001, 0x7, @userptr=0x94, 0x4}, 0x5, 0x0, r9}) setsockopt$PNPIPE_HANDLE(r10, 0x113, 0x3, &(0x7f0000002e00)=0x1000, 0x4) pipe2(&(0x7f0000004040)={0xffffffffffffffff}, 0x80000) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r11, 0x84, 0x20, &(0x7f0000004080)=0x1f, 0x4) r12 = syz_open_dev$audion(&(0x7f00000040c0)='/dev/audio#\x00', 0x5, 0x101) sendmsg$IPCTNL_MSG_CT_DELETE(r12, &(0x7f00000041c0)={&(0x7f0000004100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000004180)={&(0x7f0000004140)={0x20, 0x2, 0x1, 0x603, 0x0, 0x0, {0x1, 0x0, 0x7}, [@CTA_HELP={0xc, 0x5, 0x0, 0x1, {0x5, 0x1, '\x00'}}]}, 0x20}, 0x1, 0x0, 0x0, 0xc001}, 0x24040890) r13 = semget(0x1, 0x1, 0x10) semctl$GETNCNT(r13, 0x4, 0xe, &(0x7f0000004200)=""/36) 20:31:01 executing program 2: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000940)='tmpfs\x00', 0x0, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x100, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x68, r2, 0x8b8e0eb13081c495, 0x0, 0x0, {{}, {0x0, 0x4107}, {0x4c, 0x18, {0x60, @media='udp\x00'}}}}, 0x68}}, 0x0) sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x29282bafb6d99bfb}, 0x404c040) chdir(&(0x7f0000000300)='./file0\x00') r3 = memfd_create(&(0x7f00000002c0)='system.sockprotoname\x00', 0x0) getpeername$unix(r3, &(0x7f0000000100)=@abs, &(0x7f0000000240)=0x6e) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r3, 0x0) write$binfmt_misc(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="dc7afea08184959734c775ccefbbc44b0a03a9e45afc4ef1be01fa8dff6aa640797ea9ed66a4f8fdeaef0ad9dfbe93fc6bccc58a45983021e94740e06994342c64dd8165ebea25878b8a8da2560890b8f323579e28943ebc6c05f442ec8ab4712545e6e3d021fdf6b8ff2137a52dc71c80e3c56001709c67a1ec8cb09597ca22"], 0x80) symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00') creat(&(0x7f0000000040)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 20:31:01 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x200b01, 0x0) ioctl$TIOCMSET(r1, 0x5418, &(0x7f00000000c0)=0x2d) write$FUSE_OPEN(r1, &(0x7f0000000080)={0x20, 0x0, 0x1}, 0x20) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000000)={0x0, 'bridge_slave_1\x00', {0x3}}) [ 357.956886][T11885] IPVS: ftp: loaded support on port[0] = 21 [ 358.000076][T11871] IPVS: ftp: loaded support on port[0] = 21 20:31:02 executing program 2: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9}, 0x0) open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46000) r1 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r2 = getpid() prlimit64(r2, 0x0, 0x0, &(0x7f0000000180)) r3 = getpid() r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000740)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000900)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000008c0)={&(0x7f0000000780)={0x114, r5, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7e}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1000}, @IPVS_CMD_ATTR_DAEMON={0x6c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @empty}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1ff}, @IPVS_CMD_ATTR_SERVICE={0x60, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0xaf}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x10040850}, 0x4008011) prlimit64(r3, 0x0, 0x0, &(0x7f0000000180)) r6 = clone3(&(0x7f0000000600)={0x10081100, &(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480), {0x36}, &(0x7f00000004c0)=""/75, 0x4b, &(0x7f0000000540)=""/65, &(0x7f00000005c0)=[r3], 0x1}, 0x50) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000680)='/dev/btrfs-control\x00', 0x410000, 0x0) kcmp$KCMP_EPOLL_TFD(r2, r6, 0x7, r0, &(0x7f00000006c0)={r7, r8, 0xfffffffe}) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) sendmsg$NFNL_MSG_ACCT_NEW(r9, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x80, 0x0, 0x7, 0x3, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x9}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x5}, @NFACCT_FILTER={0x4c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x80000001}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x400}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x5}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xfffffff9}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xa1}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x1f}]}, @NFACCT_FLAGS={0x8}]}, 0x80}, 0x1, 0x0, 0x0, 0x20000040}, 0x4040801) write$cgroup_type(r1, &(0x7f0000000200)='threaded\x00', 0x52000) r10 = open(&(0x7f0000000700)='./bus\x00', 0x8060c0, 0x0) sendfile(r0, r10, 0x0, 0x8400fffffffb) ioctl$DRM_IOCTL_GET_UNIQUE(r10, 0xc0086401, &(0x7f0000000000)={0xce, &(0x7f00000000c0)=""/206}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) timerfd_gettime(r4, &(0x7f0000000940)) [ 358.215017][ T296] tipc: TX() has been purged, node left! [ 358.396258][T11885] chnl_net:caif_netlink_parms(): no params data found 20:31:02 executing program 2: r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x0, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r0, 0xc0044dfc, &(0x7f0000000040)) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f00000000c0)={0x0, {0x3}}) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x48}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000140)={'vxcan0\x00', r5}) [ 358.836051][T11885] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.843593][T11885] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.853054][T11885] device bridge_slave_0 entered promiscuous mode [ 358.872581][T11899] netlink: 'syz-executor.2': attribute type 5 has an invalid length. [ 358.962400][T11885] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.969729][T11885] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.979848][T11885] device bridge_slave_1 entered promiscuous mode [ 359.142726][T11885] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 359.221217][T11885] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 359.243236][T11899] netlink: 'syz-executor.2': attribute type 5 has an invalid length. [ 359.420146][T11885] team0: Port device team_slave_0 added [ 359.470454][T11885] team0: Port device team_slave_1 added [ 359.578600][T11885] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 359.585774][T11885] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 359.611980][T11885] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active 20:31:03 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x15) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x82, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r2, 0x80045530, &(0x7f0000000180)=""/14) setsockopt$netrom_NETROM_IDLE(r1, 0x103, 0x7, &(0x7f0000000080)=0x400, 0x4) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="6000000010000900000000c23a7e9d2cd3e95f00d637d7d60e19a6fe0ce0eb02e699fca25580ba6b6c905f5d0864e89569ff75853a75644a65860d2c4aaa27ec73261804", @ANYRES32=0x0, @ANYBLOB="0000000000002000400034801400350076657468305f6d61637674617000000014003500766c616e3000000000000000000000001400350076657468315f746f5f62617461647600"], 0x60}}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r5, 0x0, 0x0}, 0x20) getsockname$netrom(r5, &(0x7f0000000480)={{}, [@netrom, @null, @netrom, @bcast, @null, @default, @netrom, @default]}, &(0x7f0000000500)=0x48) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(0xffffffffffffffff, &(0x7f0000000340)={0x15, 0x110, 0xfa00, {r4, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e21, 0x1, @mcast2, 0x9}, @ib={0x1b, 0x5, 0x544a, {"cb94df102083d6f57dbd43b217818812"}, 0x3, 0x401, 0x1000}}}, 0x118) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) ioctl$RTC_VL_READ(r3, 0x80047013, &(0x7f0000000280)) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x1, 0x6, 0xfa, 0x1, 0x0, 0xd6a, 0x10, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x40, 0x2, @perf_config_ext={0xdf4, 0x5}, 0x2, 0x0, 0x40000, 0x8, 0x10000, 0x5, 0x3}, 0xffffffffffffffff, 0x5, r2, 0xb) [ 359.728308][T11885] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 359.735696][T11885] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 359.761924][T11885] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 359.930157][ T33] audit: type=1400 audit(1583267463.989:58): avc: denied { create } for pid=11902 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 [ 360.041976][ T33] audit: type=1400 audit(1583267464.079:59): avc: denied { write } for pid=11902 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 [ 360.090799][T11885] device hsr_slave_0 entered promiscuous mode [ 360.133929][T11885] device hsr_slave_1 entered promiscuous mode [ 360.183022][T11885] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 360.190658][T11885] Cannot create hsr debugfs directory 20:31:04 executing program 2: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000940)=ANY=[@ANYBLOB="640000001000050700"/20, @ANYRES32=0x0, @ANYBLOB="f70600150000000008000a002e0000003c0012000c00010069703667726500002c00020014000600c4e6f0e1be118746bbbf83fb842f55121400070032c6e6b6cb33caba54dd554cc9cf730a75781fdb135d9f9385bd37ee646637d4f64f6e66ea89abe812d529b170410ca772d437de51ce9dad791f61d2aae16ede787945826df07d5276163cf848046f49c06685a41efea01341bd4991c28170c7f069542387e187de1ffa59c5e2a8198d54377853c4edaf9ec437f93245ecb74791ca05552614e3dfb7cac81b9a9e133edf74181788389091e966f5d6355fd24c696a8841b17c68f42ee559b8a567000800000000000000"], 0x64}}, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) ioctl$VIDIOC_TRY_EXT_CTRLS(r0, 0xc0185649, &(0x7f0000000080)={0x990000, 0x7f, 0xfffffffd, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x990a70, 0x1, [], @p_u32}}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4}, 0x20) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000180)={r4, @in6={{0xa, 0x4e22, 0x5, @empty, 0x3}}, [0x8, 0x3f, 0x4, 0x80000001, 0x8, 0x6, 0x9, 0x31e2, 0xffffffff, 0x2, 0x4, 0x3, 0x101, 0x1, 0x3]}, &(0x7f00000000c0)=0xfc) r5 = socket(0x10, 0x800000000080002, 0x0) sendmmsg$alg(r5, &(0x7f0000000140)=[{0x900, 0x0, &(0x7f0000000100), 0xa, &(0x7f0000000100)}], 0x92492492492483d, 0x0) [ 360.523874][T11907] IPVS: ftp: loaded support on port[0] = 21 20:31:04 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x20c042, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) sendmsg$alg(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000040)="3c7f4c75543dbb586f884e7cfc632a81cbe72654dcb0b878c5fd55aa999fd6ce02edc96fb48a83f1cc4638fed2e3314517864813b6096a", 0x37}, {&(0x7f0000000080)="e64c80e2504948d4ee6f8fd0d6f9089ff184e6d0d7c7cbee60ead663ec455e4153209ebf6030f171cddf18a46bc0c126255ab41a7b94ed50e27f6c4b454af83e21a256376b14e65caea64a891804d822bf79d227938a0f3fddf4eaa3480778994676592fe29aa9c7799802d7dd132eb0915284caff233afcfa71a042332476839180f8343f306039042616431b603b7c994a9fe0361373e6c9a671bd3f82", 0x9e}, {&(0x7f0000000140)="8f6069bcf1bc1061a05615a593842ccbd5225acf366e2735b9f48fff2a0283541b1d8ddb3f3d085144676b48085308c9452d8a126f45a94fcdfb978712a73573d0060b4e427aeb152af1001bc2f3ab9aea7945b8875207b24191fe2954b0aeeb700616878ed3c601d8d33cda7380fca566c588b0dde888470d7520f617f200d20c3bb84bdd2817b1213471450f09", 0x8e}, {&(0x7f0000000200)="11520a51e6c8f8e1d09c3c6f0b3465", 0xf}, {&(0x7f0000000240)="f42cb157a27fd7b7c915a5089e562bdf5ae24751411162d63be8c979782c16bb5678a31e81341ac8cac7e758b6ce2e1364a095c8dc6dec8ff7b0fbe2ae2627c9bf3d705034af274ed5fcda84f1e89061c96847064776a01fd3df3d136fe4e992f1b923279fd1ad6cbdd5d31e341a45488c2f4ee5707911d8722c84e1fa5017048be4380ae931ee949cf486f17197ee8be4335dfde0b32785ed938d66f081b99231099a0e44", 0xa5}], 0x5, &(0x7f0000000380)=[@assoc={0x10, 0x117, 0x4, 0x200}, @assoc={0x10, 0x117, 0x4, 0x7fffffff}, @assoc={0x10, 0x117, 0x4, 0x6}, @assoc={0x10, 0x117, 0x4, 0x81}, @iv={0x58, 0x117, 0x2, 0x46, "bcfe8feeaf088c8edca7e5390b7990fd52ae91598078f843ef1beebfed5d35fe9b4b317866a0407dcf6f653916c54f6c8dd1ecea0a0d5ed45baee7200d3eaf37ad6c538e08b5"}, @iv={0x48, 0x117, 0x2, 0x38, "6939eb0bb3f96b5988426aceb48b551f397c28a3b635c1d0e239cf4388bbfd5ffdee82216704095798070d28083a79558e8f43551262a7f5"}], 0xe0, 0x40005}, 0x41) socket$inet(0x2, 0x0, 0x0) delete_module(&(0x7f0000000000)='*\x00', 0xa00) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4008ae9c, &(0x7f0000002840)={"6c64125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10010174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde318ead4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c84f7cff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"}) 20:31:04 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/anycast6\x00') r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x1000000, 0xfffffffa, 0x4, 0x6, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f0000000180)={r3}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:05 executing program 1: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0xb}) r2 = epoll_create1(0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_int(r3, 0x6, 0x0, 0x0, &(0x7f0000012ffc)) dup3(r2, r0, 0x0) 20:31:05 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) r1 = getuid() setreuid(0xee00, r1) syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f0000000080)='.\x00', 0x5, 0x1, &(0x7f0000000240)=[{&(0x7f0000000180)="d2cd5b36e7f3790c908c563a776a91770fe98117361017815f84978cd6d51b896a3b116c52b4426a34d484407e58e5b56fe070aeded08628a9603400760b17a0a7684e3fa133ca0a13db86b5e4b0b16fb6c1", 0x52, 0x3}], 0x1001, &(0x7f0000000280)={[{@norock='norock'}], [{@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@fowner_eq={'fowner', 0x3d, r1}}, {@pcr={'pcr', 0x3d, 0x23}}, {@appraise='appraise'}, {@smackfsdef={'smackfsdef', 0x3d, 'user_id'}}]}) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 361.134961][T11541] tipc: TX() has been purged, node left! [ 361.155139][T11885] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 361.249687][T11885] netdevsim netdevsim3 netdevsim1: renamed from eth1 20:31:05 executing program 1: r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x260) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, &(0x7f0000000000)=0x1, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="2000000012000102000000000a00000000000000005d2157aee42235c2770b9a3ec117249c6520be7f5bb9014862b49018e100a69380815658511f06edfc03a7fc9f8112b57a9a729ea914c988409e35e864573c6059e84057ce0312b40800000000000000529a8a9d1d1ab25676549cb1fa06264722ebb8293bf56825edeec46f68eaee1a38e83167f69a62ed8606dea0e7d306d3c1aebfb800e13d46b90963bf38e772a6d16f069986f4ed2251803db209cd7f219a2f2b4940280e7950eec53489063334c75e7e97934aceed78b2e6f4daf53a69b41858cd2e28b6e1adb1d43754aab408d0b1a3a48703fd6d6a99460f5c6804fbf194097bb6864566c887510000000000000000"], 0x20}}, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) [ 361.333138][T11885] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 361.414419][T11885] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 362.220840][T11885] 8021q: adding VLAN 0 to HW filter on device bond0 [ 362.300578][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 362.309530][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 362.346829][T11885] 8021q: adding VLAN 0 to HW filter on device team0 [ 362.413748][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 362.424086][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 362.433442][T11480] bridge0: port 1(bridge_slave_0) entered blocking state [ 362.440642][T11480] bridge0: port 1(bridge_slave_0) entered forwarding state [ 362.479012][T11907] IPVS: ftp: loaded support on port[0] = 21 [ 362.512324][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 362.521395][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 362.531711][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 362.541180][T11480] bridge0: port 2(bridge_slave_1) entered blocking state [ 362.548486][T11480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 362.625187][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 362.636256][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 362.703883][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 362.714953][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 362.753115][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 362.763083][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 362.773960][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 362.858727][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 362.868850][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 362.878473][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 362.888007][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 362.924808][T11885] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 363.031624][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 363.040104][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 363.087469][T11885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 363.174808][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 363.185586][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 363.290531][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 363.301328][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 363.329977][T11885] device veth0_vlan entered promiscuous mode [ 363.341694][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 363.350851][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 363.410395][T11885] device veth1_vlan entered promiscuous mode [ 363.575184][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 363.585428][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 363.619971][T11885] device veth0_macvtap entered promiscuous mode [ 363.651343][T11885] device veth1_macvtap entered promiscuous mode [ 363.661999][T11541] tipc: TX() has been purged, node left! [ 363.749090][T11885] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 363.759742][T11885] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 363.769799][T11885] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 363.780461][T11885] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 363.793403][T11885] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 363.803937][T11885] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 363.817685][T11885] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 363.834357][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 363.844184][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 363.854159][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 363.863980][ T4127] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 363.987271][T11885] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 363.998311][T11885] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 364.008369][T11885] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 364.018941][T11885] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 364.028963][T11885] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 364.039633][T11885] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 364.053530][T11885] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 364.061524][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 364.071656][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready 20:31:09 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x1, &(0x7f0000000040)=ANY=[@ANYPTR64=&(0x7f0000000100)=ANY=[@ANYRESOCT, @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="9c0ec3531f7d8b0e38bc606393d09a15ea3c821a054e1d9a2e9541c0e51bccad7124909fb15482be4724394f29d34d19e80e25a4c1ab73dbb9557ec5495b640c996ad8818f4110d0782403e2395d35dce99b1dbe9a7fd21df1446100331ffcea1eb89c6e52e50170f4c0c3788f88ba7ed56f5904d88f6f1ba28b0223eced1f5198179d1ae42b04000000bf660c49fa567c8dc82e4583a60d8639a28ecc08111a5a3f3431aaa1346c590c7acd7f35248657849b7a78b96554cce3716434eb515682d0628513d1501c0a7197378aa60fb266a5422f6b3a5d25a79d0df928703040b5abf3012520d657ea9969b974985c"]]], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x74) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x48}}, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000980)='/proc/asound/timers\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1a, 0x5, &(0x7f0000000ac0)=ANY=[@ANYBLOB="85100000060000001509f8fffcffffff85100000010000003bb300000000000034a3400010000000b24f847e5d3c02bdaf7d117a7500a6"], &(0x7f0000000880)='syzkaller\x00', 0x6, 0x93, &(0x7f00000008c0)=""/147, 0x40f00, 0xd, [], r2, 0xb, r3, 0x8, &(0x7f00000009c0)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000a00)={0x2, 0xd, 0x3, 0x1000}, 0x10}, 0x74) syz_read_part_table(0x0, 0x1, &(0x7f0000000180)=[{&(0x7f0000000000)="0201540000000a000000ff45ac0000ffffffa500080000000000000000400000000063000000e1000000887700720030070063000fffff000000008000da55aa", 0x40, 0x1c0}]) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setfsuid(r4) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r5, 0x0, 0x0}, 0x20) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r5, 0x8982, &(0x7f0000000140)={0x0, 'team_slave_0\x00', {0x1}, 0xaf}) r6 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="a3861b223b1e2568bacbfc8ca1474e5921270a7a63bf947ec29099275768970db64161c9a8c82aec951075eeb10bdf4368996096e6fcaeeadd2442e691d389a5adc2c289f8b5e2cd6fbf1440956189ed91041ead2da379e1840ca2d8e1271eacf3fa7773e02e5df7560601aa4b187946b9f029c5e0ea68e563efe894bdc4bb9b7f8d331cf28ae1e08ae64938707186be94600c56d0bdb887d41e534fbd59bcde4755c1341c99192022d76f12663cc226742049c11202930233b63e7b99741a4f2270a22d170c6b0de4a2524af45b8e7a67c27afe1ea222e8db15bd", 0xdb, 0xfffffffffffffffa) r7 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000240)='{\x00', r7) add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="1301a7118e521a227778ac79f4b8808100c745c728a4931a30e10a3bdc27af7cb7c460cc56ec7a7cebc1f0d728aad4ea", 0x30, r7) r8 = add_key$user(&(0x7f0000000440)='user\x00', &(0x7f0000000480)={'syz', 0x1}, &(0x7f00000004c0)="7b4c0a4d28e534246fcb832634b2c91348c00664f7b2dab73d90da0e7bfba4aa2a82e4bbbc41b95263224273b7a83d980812c48e870ef345f0d058a17739ee4a9f1b96a66ff2b9ac1ab6e43c1d4516", 0x4f, r7) r9 = request_key(&(0x7f0000000540)='pkcs7_test\x00', &(0x7f0000000580)={'syz', 0x1}, &(0x7f00000005c0)='GPL\x00', 0xfffffffffffffffc) keyctl$dh_compute(0x17, &(0x7f0000000600)={r6, r8, r9}, &(0x7f0000000640)=""/161, 0xa1, &(0x7f0000000800)={&(0x7f0000000700)={'wp384\x00'}, &(0x7f0000000740)="84607dc687fede77a5f22de5c3c7c1b6bf1cefea274af1b5561e25df1c3a6e6c68e042f6572254e957e5fbe994d4d102eade7aa51e0e292f0fe208e1de8d995f5844a70fbd1b2f2daf8f10fd135165a00caeb85e873a04e726016529af9266d16da0fc9abc8ded4746889260f513cbe9fff0d3e895c04a2081388e2c878d38020e93b8f70c4d003ba124ae07c53536c3adc32bd1c92b279786286654a07d0d7f4ee584f6777492474f3a6366b5d08494", 0xb0}) 20:31:09 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="dd"]) setresuid(0x0, 0x0, 0xee00) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x10, &(0x7f0000000000)=0xa5a1, 0x4) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:09 executing program 1: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) mmap$binder(&(0x7f0000a77000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x7f) madvise(&(0x7f0000a77000/0x1000)=nil, 0x1000, 0x12) sendfile(r0, r1, 0x0, 0x320f) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000080)={0x0, 0x0, 0x80000000, 0x3ff, 0x3, 0xdc, 0xfff8, 0x8000, {0x0, @in6={{0xa, 0x4e21, 0xff, @loopback, 0xffffffff}}, 0x401, 0x4, 0x7ff, 0x400, 0x3f}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000180)={r4, 0x2, 0x9, 0x6, 0x200, 0xffff}, &(0x7f00000001c0)=0x14) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r5, 0x0, 0x0}, 0x20) ioctl$VIDIOC_TRY_EXT_CTRLS(r5, 0xc0185649, &(0x7f0000000280)={0xed00195a2bf47be, 0x80000001, 0x6, 0xffffffffffffffff, 0x0, &(0x7f0000000240)={0x990a7d, 0xff, [], @p_u16=&(0x7f0000000200)}}) setsockopt$inet_opts(r6, 0x0, 0x9, &(0x7f00000002c0)="6040c444f1f2836b401b3e8c341ecfcf8e5f3e5639e28d78d1f1707a79475e749a799239410177d586d9d4ddc7fc02e0a5ea3dfd92b943a9f034e56c43936a9492e2c1d879f515af066275a83caafba5c3ee9a2067ad9a9b38fad938170709f10ee08330d0185a02d5dde60148a362d7134db2a50d5d9f47765083049210ae9a3e6f35226fd811cb66f9cbbd0bd6c68ced32bf", 0x93) 20:31:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000840)=@newneigh={0x30, 0x1c, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x9}, [@NDA_DST_IPV6={0x14, 0x1, @mcast2}]}, 0x30}}, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$VIDIOC_PREPARE_BUF(r1, 0xc044565d, &(0x7f0000000000)={0x740, 0xb, 0x4, 0x200000, 0xfffffffe, {0x0, 0x2710}, {0x5, 0x8, 0x80, 0x4d, 0x1, 0x5, "4f56669b"}, 0xffff, 0x1, @offset=0x1, 0xffe7, 0x0, 0xffffffffffffffff}) ioctl$TIOCSBRK(r2, 0x5427) [ 365.367284][T11971] fuse: Bad value for 'group_id' [ 365.389232][T11974] fuse: Bad value for 'group_id' 20:31:09 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f00000004c0)='./file0\x00', 0x0, 0x7a04, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x60c500, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000080)='cpuset.cpus\x00', 0x2, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000140)={{&(0x7f0000ffc000/0x2000)=nil, 0x2000}, 0x1}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioctl$VIDIOC_G_AUDOUT(r3, 0x80345631, &(0x7f00000002c0)) getsockname$packet(r4, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x48}}, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000001c0)="870bc4fc53e088d77b894d7e814caa61f78db0c7cdd7d0c4007bdd5d7809f60d877b34e2e2a0e661757a39510bf1e24bc90fe5ea20dec54fa2d1017ca6bef6409d64507e83e1c9f21586a7ca43a773fa86034ac8f904c7cff13ab291c3272710be75db99b4ba70bf", 0x68, 0x4000000, &(0x7f0000000240)={0x11, 0x2, r5, 0x1, 0xc9}, 0x14) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000180)="de0ca3e1b3f952e65576160299ab2c", 0xf}, {&(0x7f0000000100)="0ea08677bd2cab0400b986", 0xb}], 0x2) 20:31:09 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, 0x0, 0x8, 0x101, 0x0, 0x0, {0x3}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_CLOSING={0x8}, @CTA_TIMEOUT_DCCP_TIMEWAIT={0x8}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x9200}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) ioctl$IMCTRLREQ(0xffffffffffffffff, 0x80044945, &(0x7f0000000000)={0x2000, 0x6, 0x1, 0x4000ffff}) [ 365.496325][T11976] netlink: 'syz-executor.3': attribute type 5 has an invalid length. 20:31:09 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d30303030303030b03030303030303030303034303030332c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 365.637812][T11977] loop3: p1[DM] p2 p3 p4 [ 365.642544][T11977] loop3: partition table partially beyond EOD, truncated [ 365.650141][T11977] loop3: p1 start 10 is beyond EOD, truncated [ 365.656377][T11977] loop3: p2 size 1073741824 extends beyond EOD, truncated [ 365.680037][T11977] loop3: p3 start 225 is beyond EOD, truncated [ 365.686577][T11977] loop3: p4 start 255 is beyond EOD, truncated [ 365.759610][ T33] audit: type=1400 audit(1583267469.819:60): avc: denied { create } for pid=11985 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 365.881453][ T33] audit: type=1400 audit(1583267469.859:61): avc: denied { write } for pid=11985 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 365.938127][T11976] netlink: 'syz-executor.3': attribute type 5 has an invalid length. [ 365.967546][T11993] fuse: Bad value for 'rootmode' [ 365.994997][T11997] fuse: Bad value for 'rootmode' 20:31:10 executing program 2: r0 = memfd_create(&(0x7f00000000c0)='queue1\x00\x00\x00\x00\x00\x00\x00\x001;\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\xcc\xbf}\xdd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb2\x1e\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x81) ioctl$SNDCTL_DSP_CHANNELS(0xffffffffffffffff, 0xc0045006, &(0x7f0000000100)=0x81) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) read(r2, &(0x7f00000003c0)=""/204, 0xcc) r3 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000200)={0x0, 0x0, 0x0, 'queue0\x00', 0x305}) semctl$IPC_INFO(0x0, 0x0, 0x3, &(0x7f00000002c0)=""/234) write$sndseq(r0, &(0x7f0000000000), 0x9fab6a25) [ 366.053319][T11992] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 366.107354][T11982] loop3: p1[DM] p2 p3 p4 [ 366.111992][T11982] loop3: partition table partially beyond EOD, truncated [ 366.119613][T11982] loop3: p1 start 10 is beyond EOD, truncated [ 366.125896][T11982] loop3: p2 size 1073741824 extends beyond EOD, truncated 20:31:10 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x40000, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000580)='/dev/dlm_plock\x00', 0xa42, 0x0) ioctl$VIDIOC_G_CTRL(r2, 0xc008561b, &(0x7f00000005c0)={0x464, 0x6}) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f00000002c0)='/dev/fuse\x00', 0x0, 0xffffffffffffff9c) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2ca5"]) setresuid(0x0, 0x0, 0xee00) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000480)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x38, r4, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@SEG6_ATTR_SECRET={0xc, 0x4, [0x7, 0xffff]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x4a}, @SEG6_ATTR_ALGID={0x5}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x801) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r5, 0x0, 0x0}, 0x20) ioctl$SIOCPNDELRESOURCE(0xffffffffffffffff, 0x89ef, &(0x7f0000000300)=0x81) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x1, 0x80000, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$VHOST_SET_VRING_ERR(r5, 0x4008af22, &(0x7f0000000080)={0x0, r5}) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x20, 0x10, 0x705, 0x0, 0x25dfdbfd}, 0x20}}, 0x0) connect$packet(r5, &(0x7f0000000000)={0x11, 0x9, r8, 0x1, 0x95}, 0x14) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 366.237478][T11998] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 366.276117][T11982] loop3: p3 start 225 is beyond EOD, truncated [ 366.283248][T11982] loop3: p4 start 255 is beyond EOD, truncated [ 366.334447][T11541] tipc: TX() has been purged, node left! 20:31:10 executing program 2: syz_mount_image$jfs(&(0x7f0000000040)='jfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={[{@discard='discard'}, {@iocharset={'iocharset', 0x3d, 'none'}}], [{@uid_lt={'uid<'}}]}) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x8002, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req={0x6, 0x4e, 0x6, 0x6}, 0x10) 20:31:10 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xbc, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff000000003f040000000000002d400500000000004704000001ed00007b130000000000006c440000000000007a0a00fe00ffffffdb03000000000000b5000000000000009500000000000000023bc065b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5e69048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24c87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b728fe26e37037f27feeb744ddcc536cbae315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293986e02c8e0a6dda1eca493f1479531dd8826fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a8784d0899ed888141e2fae6691d1aee1da02ba516467df3e7d1daac19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec01a8aa7749f3187e9efb"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x74) [ 366.489838][T12009] fuse: Unknown parameter '0x0000000000000003' 20:31:10 executing program 1: pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x800) setsockopt$PNPIPE_ENCAP(r0, 0x113, 0x1, &(0x7f0000000080), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0xe, 0x0, &(0x7f0000346fc8)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x8101, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180)='ethtool\x00') r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x48}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r9}]}, 0x48}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r11, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r12}]}, 0x48}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wg1\x00', 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe4) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f0000000500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0xf4, r3, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}, @ETHTOOL_A_LINKINFO_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_LINKINFO_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip_vti0\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x40891}, 0x8000) ioctl$KDDELIO(r1, 0x4b35, 0xbb) [ 366.597154][T12010] fuse: Unknown parameter '0x0000000000000005' [ 366.700242][T12016] JFS: discard option not supported on device [ 366.706736][T12016] jfs: Unrecognized mount option "uid<00000000000000000000" or missing value 20:31:10 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xa3, 0x2000}, [@ldst={0x0, 0x0, 0x2, 0x0, 0x4}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x74) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x20000, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x0, 0x4) 20:31:10 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080)='NLBL_CALIPSO\x00') r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="a6ed24ce94c952edb87b062c9c741c57a498340a85fde1a1162522b2a3c854ac8095c82703f14d7fdefc14fcda31acafa9dcb99efb42bdb8fd8defb68f26d2ecb9e07fbbe390aa01c9e3df7f", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',(']) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 366.837048][T12016] JFS: discard option not supported on device [ 366.843488][T12016] jfs: Unrecognized mount option "uid<00000000000000000000" or missing value [ 366.986095][T12024] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 367.203126][T12032] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 367.223500][T12033] fuse: Unknown parameter '¦í$ΔÉRí¸{' [ 367.304769][T12037] fuse: Unknown parameter '¦í$ΔÉRí¸{' [ 367.434141][T12040] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 20:31:11 executing program 3: r0 = socket$inet_dccp(0x2, 0x6, 0x0) openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f0000000000)=0x7ff, 0x4) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) getsockopt$inet_int(r0, 0x10d, 0xf1, 0x0, &(0x7f0000000080)) 20:31:11 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="7cfe24d583b5526fed2c0000000000000000"]) setresuid(0x0, 0x0, 0xee00) syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0x0, 0x2200) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nvram\x00', 0x42002, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000240)={0x7ff, 0x5, 0x1, 'queue1\x00', 0x8001}) [ 367.743426][T12040] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 367.826669][T12050] fuse: Bad value for 'group_id' [ 367.832116][ T33] audit: type=1400 audit(1583267471.889:62): avc: denied { map } for pid=12047 comm="syz-executor.3" path="/dev/full" dev="devtmpfs" ino=17328 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:null_device_t:s0 tclass=chr_file permissive=1 [ 367.887718][T12053] fuse: Bad value for 'group_id' 20:31:12 executing program 3: socket$kcm(0x10, 0x2, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008111e00f80ecdb4cb9f207c804a011000000880412fb0a0002000a11da1b40d805000300c50083b8", 0x2e}], 0x1, 0x0, 0x0, 0x5865}, 0x0) [ 367.912411][T12043] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 367.998518][T12052] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 20:31:12 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r5 = getuid() setreuid(0xee00, r5) mount$9p_rdma(&(0x7f00000002c0)='127.0.0.1\x00', &(0x7f0000000300)='./file0\x00', &(0x7f0000001400)='9p\x00', 0x0, &(0x7f0000001440)={'trans=rdma,', {'port', 0x3d, 0x4e20}, 0x2c, {[{@common=@cache_fscache='cache=fscache'}, {@sq={'sq', 0x3d, 0x9}}, {@timeout={'timeout', 0x3d, 0x100000001}}], [{@pcr={'pcr', 0x3d, 0x3d}}, {@uid_gt={'uid>', r5}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@subj_type={'subj_type', 0x3d, 'connmark\x00'}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@subj_type={'subj_type', 0x3d, '/dev/dlm_plock\x00'}}, {@smackfsfloor={'smackfsfloor'}}, {@fsmagic={'fsmagic', 0x3d, 0x3}}]}}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) r7 = getuid() setreuid(0xee00, r7) r8 = getuid() setreuid(0xee00, r8) r9 = getuid() setreuid(0xee00, r9) fstat(r0, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r11 = msgget$private(0x0, 0x288) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) r14 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCSIFDSTADDR(r14, 0x8918, &(0x7f00000002c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}}) getsockopt$inet6_IPV6_XFRM_POLICY(r14, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000140)=0xe4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) r17 = getpgid(0x0) r18 = clone3(&(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x50) migrate_pages(r18, 0x6, &(0x7f0000000000)=0x7fffffff, &(0x7f0000001ac0)=0x2) syz_open_procfs(r18, &(0x7f0000000080)='attr/fscreate\x00') msgctl$IPC_SET(r11, 0x1, &(0x7f0000000440)={{0x3, r12, r13, r15, r16, 0x180, 0x6}, 0x0, 0x0, 0x10001, 0x4, 0x7, 0x80, 0xff, 0x4, 0xec87, 0x4, r17, r18}) getresgid(&(0x7f0000001640)=0x0, &(0x7f0000001680), &(0x7f00000016c0)) lstat(&(0x7f0000001700)='./file0\x00', &(0x7f0000001740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r21 = msgget$private(0x0, 0x288) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) r24 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCSIFDSTADDR(r24, 0x8918, &(0x7f00000002c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}}) getsockopt$inet6_IPV6_XFRM_POLICY(r24, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000140)=0xe4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) r27 = getpgid(0x0) r28 = clone3(&(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x50) migrate_pages(r28, 0x6, &(0x7f0000000000)=0x7fffffff, &(0x7f0000001ac0)=0x2) syz_open_procfs(r28, &(0x7f0000000080)='attr/fscreate\x00') msgctl$IPC_SET(r21, 0x1, &(0x7f0000000440)={{0x3, r22, r23, r25, r26, 0x180, 0x6}, 0x0, 0x0, 0x10001, 0x4, 0x7, 0x80, 0xff, 0x4, 0xec87, 0x4, r27, r28}) r29 = getegid() r30 = msgget$private(0x0, 0x288) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) r33 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet6_SIOCSIFDSTADDR(r33, 0x8918, &(0x7f00000002c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}}) getsockopt$inet6_IPV6_XFRM_POLICY(r33, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@local, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000140)=0xe4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) r36 = getpgid(0x0) r37 = clone3(&(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x50) migrate_pages(r37, 0x6, &(0x7f0000000000)=0x7fffffff, &(0x7f0000001ac0)=0x2) syz_open_procfs(r37, &(0x7f0000000080)='attr/fscreate\x00') msgctl$IPC_SET(r30, 0x1, &(0x7f0000000440)={{0x3, r31, r32, r34, r35, 0x180, 0x6}, 0x0, 0x0, 0x10001, 0x4, 0x7, 0x80, 0xff, 0x4, 0xec87, 0x4, r36, r37}) fsetxattr$system_posix_acl(r1, &(0x7f0000001580)='system.posix_acl_access\x00', &(0x7f00000017c0)={{}, {0x1, 0x6}, [{0x2, 0x2, r5}, {0x2, 0x7, r7}, {0x2, 0x7, r8}, {0x2, 0x0, r9}, {0x2, 0x9, r10}], {}, [{0x8, 0x0, r13}, {0x8, 0x1, r19}, {0x8, 0x7, r20}, {0x8, 0x2, r23}, {0x8, 0x3, r29}, {0x8, 0x4}, {0x8, 0x6, r35}], {0x10, 0x2}, {0x20, 0x2}}, 0x84, 0x3) fdatasync(r6) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r4, 0x40405514, &(0x7f0000000240)={0x6, 0x6, 0x8, 0x228, 'syz0\x00', 0x401}) getsockname$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r38}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000400)=@delchain={0x1000, 0x65, 0x1, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r38, {0x0, 0xffe4}, {0x4}, {0xfff2, 0x5}}, [@filter_kind_options=@f_basic={{0xa, 0x1, 'basic\x00'}, {0xd14, 0x2, [@TCA_BASIC_POLICE={0xc, 0x4, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x4}]}, @TCA_BASIC_ACT={0x574, 0x3, [@m_connmark={0x78, 0x20, 0x0, 0x0, {{0xd, 0x1, 'connmark\x00'}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x9, 0x10000000, 0x156, 0x5}}}]}, {0x41, 0x6, "da1c59b896c7f507ab7188a552bc34dcb9a29bfee6c4707f26820033427b17b8b55f2b1a11a96220099059344d6588c28fe397757fb0828d51d8dbfde7"}}}, @m_ctinfo={0x124, 0xb, 0x0, 0x0, {{0xb, 0x1, 'ctinfo\x00'}, {0x64, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x9}, @TCA_CTINFO_ACT={0x18, 0x3, {0xffff, 0x1d, 0x5, 0x1, 0x7fffffff}}, @TCA_CTINFO_ACT={0x18, 0x3, {0x9d, 0x2002, 0xd61354932b3c8a9b, 0x6, 0x8}}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x8}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x9}, @TCA_CTINFO_ACT={0x18, 0x3, {0x9, 0x0, 0x10000000, 0x5cd2, 0x6}}]}, {0xae, 0x6, "1929f7ccd68aa66813d0edb387ae7a15382d0edf9e160fdb85f5fb74f26afca9532f60dca6feccfcad97e0b900864bb00fe0cee1fecf81dc11b1cf57552466edd04cc7b8352a77017bf248767a935e9a192819e18eecdad276a6035c6c5feccd6e80138fee470746973842331137afa133997a01ef544d146e17bc115edfc7f288b228278ac4dcf9dfefa59a2448e6b7d5a5d9706bbaa19798a5c173606379eb792d3a86213f7a14df72"}}}, @m_gact={0xec, 0x14, 0x0, 0x0, {{0x9, 0x1, 'gact\x00'}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x242d, 0x7}}, @TCA_GACT_PARMS={0x18, 0x2, {0x3ff, 0x5b6b, 0x3, 0x0, 0xf031}}]}, {0xb4, 0x6, "0c445f219815621e77fe3075bf6c2beb1a7a37b66c5bfc1a689d8c8db814badbbada79113a33977fbd0b6699d91272bc48ca3c8bf4172e42fb84dab1442f3fc4a9feefb492a7bb9751c9fb41dffd9b934d4d9022f680b31f829a32c67391093677161db584d04cbbc8e91edcb76af0f3284227829b010419f17da844a9258953dff8178f27c7986cfb231f06c5e3d50da7a48dda5348e8626533c07bb212a81f46436ebe1ccac2f4dddeadacdc514bf8"}}}, @m_skbedit={0xf8, 0x10, 0x0, 0x0, {{0xc, 0x1, 'skbedit\x00'}, {0x74, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xc, 0xb}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xd}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x92}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x7, 0x0, 0x5, 0x4, 0x4}}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x3, 0xd}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x8, 0x9, 0x4, 0xffffffff}}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x401, 0x7e, 0xffffffffffffffff, 0x9, 0x42}}, @TCA_SKBEDIT_MARK={0x8}]}, {0x74, 0x6, "a1058465ba6c4155769c32b0c46ba9211f91461297fabf077c1c6312f781162db45bbe406893dddf2aeea23858fb36dd214bea9608060203c81d7e10f36f159ad1d8a585cb8720dca5af70e1c71eb8ab3300d5a6e1a58e83b53ea9aa9e0cc853030d436b48d29748bf60069344565277"}}}, @m_csum={0x1f0, 0xb, 0x0, 0x0, {{0x9, 0x1, 'csum\x00'}, {0x11c, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x0, 0x8, 0x0, 0x80000001}, 0x1e}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x1, 0x7, 0xffff8001, 0x6}, 0x7a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xdf9a, 0x9, 0x1, 0x9, 0x5}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x40, 0x6, 0x4, 0x9}, 0x7f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x3, 0x4, 0x6, 0x4, 0xfffffffe}, 0x78}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x401, 0x7f, 0xfffffffffffffff9, 0x8, 0x8}, 0x23}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x5, 0x0, 0x7, 0xc02, 0x9}, 0x19}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x4, 0x4, 0x10001, 0x5}, 0x56}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x40, 0x6, 0x1, 0x9cd2, 0x1000}, 0x71}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x8fe, 0x8, 0x5, 0x5}, 0x2a}}]}, {0xc4, 0x6, "8313ef753d515183e72e5b8ffcc8936c15dfb95d75abc62ba69fc1deaa283866bc0d1958a6d454491052651861ed9b5a539478865d388abc1be753f07bbddca28da8bb5a0030db07910b9379245ebd5de6affbc5d0b2b08171c6e3362835b027f138085f95f5d07bc1518ccafdacc3e81b96213b07453325956cfa376f3a09beb6dee04d5a56d8b707e07e9f13a39f7c894e84ea61bb3e4648bdb30b4317e42ef9440057117c16e7af80fcfea1569c23bd25f1df1cef3724b0325259a83f53a6"}}}]}, @TCA_BASIC_POLICE={0x408, 0x4, [@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x5, 0xc1, 0x9, 0xeec, 0x3, 0x3, 0x1, 0x6, 0x81, 0xe0, 0x20, 0x3f, 0x8, 0x2, 0x6, 0x5d, 0xbc, 0x7, 0x6, 0x20, 0x2186, 0x8, 0x3ff, 0x1, 0x8001, 0x6, 0x4, 0x4040, 0x7, 0x3, 0x3, 0x6, 0x7f, 0x0, 0x7, 0x9, 0xbc, 0x1b, 0x4, 0x342a, 0x5, 0xfffffc00, 0x1, 0xfff, 0x9c2, 0x7f, 0x1f, 0x2, 0x9, 0xfffffff7, 0x4, 0x800, 0xfffffff9, 0x6, 0x10001, 0x7f, 0x101, 0x1, 0x0, 0x5, 0x60d3e8e7, 0x2, 0x593b, 0xfc000000, 0x4fe, 0x101, 0x33b, 0x3, 0xec7, 0xfb73, 0xfffffeff, 0x5, 0x9, 0x617, 0x3ff, 0xad5, 0x7ff, 0x83bc, 0xfffff000, 0x6, 0x3, 0x81, 0x1, 0xe4, 0x10000, 0x101, 0x7, 0x6, 0x1fffc, 0x80000001, 0x4000, 0x7fff, 0x6, 0x0, 0x1000, 0x1, 0x9, 0x467e, 0x9, 0x0, 0xf4ac, 0xff, 0x1000, 0x100, 0x81, 0x1, 0x3, 0x2, 0x10000, 0x6, 0x4, 0x0, 0x8, 0x8, 0x6, 0x307, 0x4cf, 0x3, 0x6, 0x4, 0xc3, 0x12d2, 0x3, 0x0, 0x0, 0x0, 0x3, 0xc2b, 0x400, 0x7fff, 0x8a, 0xb10, 0x3, 0x120000, 0x10000, 0x9, 0x20, 0x4, 0x8, 0xffffffff, 0x0, 0xfffffff7, 0x7, 0x1, 0xfffffffd, 0x2, 0x401, 0x80000001, 0x8, 0x81, 0x5d6d, 0x9bf, 0x0, 0xfffffffc, 0x8, 0x5, 0x6, 0x1000, 0x7, 0x8, 0x1000, 0x1f, 0x1000, 0xfffffff9, 0x1f, 0x401, 0xfffffe01, 0x3, 0x38f, 0xfffffff9, 0x7, 0xf493, 0x5f39, 0x5, 0x8b, 0xfffffbff, 0x101, 0x6, 0x7f, 0x5, 0x55, 0x21b3, 0x100, 0xfc000000, 0xffff, 0xd16, 0xffffff4c, 0x3, 0x3, 0x8, 0xfff, 0x572b, 0x7fffffff, 0x8000, 0x10001, 0x1, 0x3, 0x2, 0x7f, 0x3d18715c, 0x2, 0xda2, 0x8, 0x9, 0x7fffffff, 0x4, 0x0, 0xddbd, 0xc52e, 0x3ff, 0x8ef, 0xffff, 0xfffffffe, 0x8, 0x8, 0x4, 0x6, 0x2, 0xb6, 0x8001, 0x1, 0x5, 0x0, 0x6, 0x81, 0x9, 0x8, 0x1, 0x7, 0x2, 0x6, 0x2, 0x1f, 0x0, 0x2, 0x3, 0x3, 0xffffd3cc, 0x9, 0x1, 0xf4c, 0x9, 0x8001, 0xff, 0x20, 0x1, 0x4, 0xe5e7, 0xab98, 0xdae80000, 0x1ffe0, 0x7, 0x4, 0x1000]}]}, @TCA_BASIC_ACT={0x388, 0x3, [@m_mirred={0x128, 0x1d, 0x0, 0x0, {{0xb, 0x1, 'mirred\x00'}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x5, 0x6, 0x10000000, 0x2, 0x7}, 0x4}}]}, {0xf4, 0x6, "39222e7523d09479b4bce785110addefbd308f3d18e9bd1122c4020f8019197b35e4751aaf88a5f135eaf330ebf20a0aecb9c32f3c67c23b8fb1e40a16d459bb5643e3b942763d83cea540faa98c21ccddeb77456b9072d8a336804c655cccb479102118a5f45c839e732c1eb17e9b896f29359f74403cc45271440079c2de7805a20a63f525205f228fc4e775dbf1a3f4f41816f1d08ba9836f81409c68d7513b84e0b2e30b2aafebbe5b57cd43ebdecbc1870b1e1dff998233faba20cd2cdeb422751500686879b3518276fefe01917bc523ac9fee313f36db5bd538a3d2e6f8eda8c89f647207dd1bd017d57a67f5"}}}, @m_xt={0x25c, 0x6, 0x0, 0x0, {{0x7, 0x1, 'xt\x00'}, {0x1a4, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0xf9, 0x6, {0xfff8, 'security\x00', 0x1f, 0x3f, "ba195930070645337d50e228db5e63893c67053463a57b1aaf63ebc8a9a3d69771b5eacc615bf58f7a2aa68d347c58344457a6c802ee9c11b4e59b41330c109ced0d0d5e5a4386caf8a0a86e1a83952d11e8661ad6c43bc69b55dfc07637d703ace0e35bc7e340af1c43cce19f75d02400122b5cb787713b5a44171407b60bde0cc193e0f912c406ce04413bf2ba35176b4ad2144fb95d0fc14e8f83904997b219d296a50337968a7e934f880e058b6beb56d7a78bb8c11704e0df6d7f0b842b8d74aeaf5886134ec32cfe2c3c339e"}}, @TCA_IPT_TABLE={0x24, 0x1, 'raw\x00'}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_INDEX={0x8, 0x3, 0x5}, @TCA_IPT_TARG={0x51, 0x6, {0xd27, 'mangle\x00', 0x6, 0x5d2, "322d117c71ab25421a29e8bddfa2d261774166bbbae526c2ef00a94deddf86541bad32fc8df0fe"}}]}, {0xaa, 0x6, "89555f422e954388be2c350c1ec7901cd6d1066456f866706d224182f228bf3f29086bd6acc1cd83731e173b4900b75a36b9922b2ba55a302069803451f9203cb5056866686cc2f7ddcbd565d1d0fa724c7f34a3db0481090a2800b673ddb51f13868e528b84b01e076b2002c6f0b07e136fd2aecb5e6b97b8af2ee003326e31d9f383e014e80bdf378315418da7bfc01e0790c5d258fdb0eccf9a8503bd632167d6058ddf2d"}}}]}]}}, @filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x2a8, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1436e}, @TCA_FLOW_MASK={0x8, 0x6, 0x80}, @TCA_FLOW_EMATCHES={0x27c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x1c8, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0x44, 0x1, 0x0, 0x0, {{0xf189, 0x0, 0xfff}, "a5c57f006673a5f29540fbfb92d38f46db874ef480203adaa9c0155a29e61b6948381901ca77fa3e11d19473ac3d94956a2789aa36131bca"}}, @TCF_EM_IPSET={0x10, 0x1, 0x0, 0x0, {{0x2, 0x8, 0x8}, {0x0, 0x0, 0x4}}}, @TCF_EM_CONTAINER={0x108, 0x1, 0x0, 0x0, {{0xb9b6}, "0f48d9afd32bee5384929bba55b99b622771bd2b65c5638891e9512782895543f86f54fed386f21bcacdc4119a6abbb71795ebc2934bf9823dc3038d00a70595f7580fdc488721f73f18a8397cddbb98bd3ad68455e49c6502480ca7151089edfc2357c7d34b0581dd97c6c8171851b059866ae99a8a02f05c950c762eb7a49c09013c64357eff3f28471c8d80a7a61bb6bc37dc4b999f3fc8fcd1c4ab3c9a111971f62548772dc7e7277f843ceb02f931776148854d749dba03d4b929065f2a8d11e44ae6a53a56cc939159b6bbb285c7eff319f77e3111ab710c83ae5a3198a4a13fd6de4d740b6003d223ea91917e80b36670b47b0aa0991232"}}, @TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x9, 0x7, 0x2}, {{0x3, 0x1, 0x1}, {0x0, 0x1, 0x1}}}}, @TCF_EM_IPT={0x1c, 0x3, 0x0, 0x0, {{}, [@TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0x9}, @TCA_EM_IPT_MATCH_REVISION={0x5, 0x3, 0xde}]}}, @TCF_EM_NBYTE={0x1c, 0x2, 0x0, 0x0, {{0x40, 0x2, 0x9}, {0x1000, 0x7, 0x2, "aab01cb41307f4"}}}, @TCF_EM_NBYTE={0x1c, 0x2, 0x0, 0x0, {{0x8, 0x2, 0xc458}, {0x9, 0xa, 0x0, "511e0e30f3726c46033f"}}}]}, @TCA_EMATCH_TREE_LIST={0xa0, 0x2, 0x0, 0x1, [@TCF_EM_META={0x3c, 0x1, 0x0, 0x0, {{0x1, 0x4, 0xff}, [@TCA_EM_META_HDR={0xc, 0x1, {{0xffff, 0xff, 0x1}, {0x800, 0xe1, 0x2}}}, @TCA_EM_META_LVALUE={0x24, 0x2, [@TCF_META_TYPE_VAR="2741c9c0999b9773e9", @TCF_META_TYPE_VAR="ffbb1cb2511d", @TCF_META_TYPE_VAR="e1631206ca", @TCF_META_TYPE_VAR='Z`NL', @TCF_META_TYPE_VAR="c21d30b01904eae1"]}]}}, @TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x1, 0x3, 0x180}, {0x1, 0x0, 0x2}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x200, 0x1, 0x8}, {0xfffffffa, 0xaf, 0x800, 0x3, 0x8, 0x0, 0x2}}}, @TCF_EM_CMP={0x18, 0x3, 0x0, 0x0, {{0x7, 0x1, 0xfff9}, {0x6, 0xf1c, 0xfbff, 0x1, 0x1, 0x1}}}, @TCF_EM_NBYTE={0x14, 0x2, 0x0, 0x0, {{0x7, 0x2, 0x1}, {0x5}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x20}}]}, @TCA_FLOW_BASECLASS={0x8, 0x3, {0x2, 0xe}}, @TCA_FLOW_DIVISOR={0x8, 0x8, 0xff}, @TCA_FLOW_PERTURB={0x8, 0xc, 0x1ff}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0x1}}]}, 0x1000}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000811) 20:31:12 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000000)='tmpfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x16, 0x0, 0x0, &(0x7f00000000c0)={[{@mode={'mode', 0x3d, 0xfff}}]}) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0xa, &(0x7f0000000040), &(0x7f0000000100)=0x4) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x408) 20:31:12 executing program 1: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={0x0, @multicast2, @loopback}, &(0x7f0000000180)=0xc) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x800, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5}, 0x20) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000002c0)={r5, @in6={{0xa, 0x4e21, 0x5, @rand_addr="138a607a586b9ea92cc7b1127c71ccb1", 0x9}}, 0x40, 0x5}, &(0x7f0000000380)=0x88) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x19) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) ioctl$KVM_GET_IRQCHIP(r6, 0xc208ae62, &(0x7f00000003c0)) syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000140)="014344303031", 0x6, 0x8010}], 0x0, 0x0) lsetxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=@random={'btrfs.', 'iso9660\x00'}, &(0x7f0000000240)='@posix_acl_access.\x00', 0x13, 0x5) [ 368.844276][T12066] isofs_fill_super: bread failed, dev=loop1, iso_blknum=32, block=64 [ 369.115480][T12078] isofs_fill_super: bread failed, dev=loop1, iso_blknum=32, block=64 20:31:13 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r0, 0x40045730, &(0x7f0000000040)=0x400) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @rand_addr="0000000c5400e6ffffffffffffff00", 0x2}, 0x1c) syz_emit_ethernet(0x4f, &(0x7f0000000100)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '?\x00', 0x19, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@mptcp=@ack={0x1e, 0x3}]}}, {'Y'}}}}}}}, 0x0) 20:31:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=@newtaction={0x18, 0x31, 0x727, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0205710, &(0x7f0000000000)={0x1, 0x990d, 0xffff}) 20:31:13 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:14 executing program 1: socket$netlink(0x10, 0x3, 0x0) syslog(0x4, &(0x7f0000000080)=""/130, 0x82) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r5, 0x0, 0x0}, 0x20) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r8, 0x0, 0x0}, 0x20) fsetxattr$security_selinux(r8, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:mouse_device_t:s0\x00', 0x24, 0x2) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000001c0)=ANY=[@ANYRESDEC=r5, @ANYRESDEC=r7, @ANYRES64=0x0, @ANYRES32, @ANYPTR=&(0x7f0000000280)=ANY=[@ANYRES64=r9, @ANYRESHEX=r2, @ANYBLOB="08d0f9bf314f89a06519667062cc88d417908fcc4a0404c3450bfb1de6df9e2cd462d6559a0bdc9d59a114405982b285990fb882a877", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYPTR, @ANYPTR, @ANYRESHEX=r3]], @ANYRESDEC=r4], 0x6}}, 0x0) 20:31:14 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) ioctl$TCGETS2(r1, 0x802c542a, &(0x7f0000000180)) 20:31:14 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x238f81, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) ioctl$CAPI_NCCI_OPENCOUNT(r0, 0x80044326, &(0x7f0000000040)=0x4) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r1, 0x40000000af01, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000300)=""/246, 0x0}) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xff7fffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0xc0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0), 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, r4}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, r4}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, r3, 0x0, 0x4, &(0x7f0000000180)='em1\x00', r4}, 0x30) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000240)={r4}, 0xc) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000080)={r4}, 0xc) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f0000000000)={0x200000000001, r2}) 20:31:14 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x0, 0x0) sendmsg$IPSET_CMD_GET_BYNAME(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x54, 0xe, 0x6, 0x401, 0x0, 0x0, {0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x2, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x40084}, 0x11) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:14 executing program 3: ioctl$VIDIOC_QUERY_EXT_CTRL(0xffffffffffffffff, 0xc0e85667, &(0x7f0000000200)={0x0, 0x2, "d294be2715a8711098744cd2a0f1c0a380cccee459d57eb4aea1198b0b675168"}) syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="8da4363ac0ed02000a0000000001004d010000000000000000007a0000000000fff6f2a2299748aeb81e1b00b10efd9a000001000000000001fffffff60000005f42485266535f4d", 0x23b, 0x10000}], 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) 20:31:15 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="4800000010001fff000005000000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010076786c616e0000001800028014001200e00000b6a19c324dec3fab0ebbc757c7bc7f458168a5d5a12af6f4cebbba3a6b286cc70230251b0cfaec50864c69e23dabdda2e67d7a4e7d06c890f9a743e6f134", @ANYRES32=0x0, @ANYBLOB="f6ccaa5be8c20b3fffff000000000000becee9cd29aa516d8c429bf4458abc4905fc5e4477954181cc82894c55ef72a9"], 0x48}}, 0x0) [ 371.079605][T12126] BTRFS: device fsid fff6f2a2-2997-48ae-b81e-1b00b10efd9a devid 10957382860115787412 transid 0 /dev/loop3 scanned by syz-executor.3 (12126) [ 371.139702][T12126] BTRFS error (device loop3): superblock checksum mismatch [ 371.197001][T12126] BTRFS error (device loop3): open_ctree failed 20:31:15 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x80, 0x0) write$midi(r2, &(0x7f0000000280)="58ac60f24f64771c342a1a7577e2b18636490b0b3d1aad6f694c595ddbd21c954313d11a7fea69c6d53712cdb996016780ca332761a7a81e8bed2c194485206d7af0510ea99a0dac68e8df77398767bb5933549e2803ec808b13e26fe009852bf3369858c1c9905004aa5e36ffb5ed59281eda36b8400b3c7b0a53d01ee961fcdff8be34a40e002c8428f6b1f1062cc8aba9e4052d3350e86ac2d569c7dc74265012fd38bf7a4a450de8487772b830dd77b242d2c3632f515f40e7e416d3d7d6efc0aa1b850177c752dc6bd8063603521f5c9f", 0xd3) request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000240)='{\x00', r1) add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="1301a7118e521a227778ac79f4b8808100c745c728a4931a30e10a3bdc27af7cb7c460cc56ec7a7cebc1f0d728aad4ea", 0x30, r1) r3 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000240)='{\x00', r3) add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="1301a7118e521a227778ac79f4b8808100c745c728a4931a30e10a3bdc27af7cb7c460cc56ec7a7cebc1f0d728aad4ea", 0x30, r3) keyctl$unlink(0x9, r1, r3) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 371.319741][T12131] netlink: 'syz-executor.1': attribute type 18 has an invalid length. 20:31:15 executing program 3: ioctl$VIDIOC_QUERY_EXT_CTRL(0xffffffffffffffff, 0xc0e85667, &(0x7f0000000200)={0x0, 0x2, "d294be2715a8711098744cd2a0f1c0a380cccee459d57eb4aea1198b0b675168"}) syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="8da4363ac0ed02000a0000000001004d010000000000000000007a0000000000fff6f2a2299748aeb81e1b00b10efd9a000001000000000001fffffff60000005f42485266535f4d", 0x23b, 0x10000}], 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) 20:31:15 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000080)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000101", 0x1c, 0x2c, 0x0, @rand_addr="fe800000000000004ce33c06799c8423", @local, {[@hopopts={0x2c}], {{0x2c00, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$VIDIOC_G_MODULATOR(r1, 0xc0445636, &(0x7f0000000100)={0x9, "a2b17e261938730c40b5dc6b5153d4f72be7ada522326a0573bdc0c3ae1d8e8a", 0x1000, 0x4, 0x20, 0x2, 0x1}) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x0) [ 371.795387][T12143] BTRFS error (device loop3): superblock checksum mismatch 20:31:15 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2cb31b4f8ea700"]) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 371.843733][T12143] BTRFS error (device loop3): open_ctree failed [ 372.137104][T12154] fuse: Unknown parameter '³OŽ§' [ 372.167209][T12155] fuse: Unknown parameter '³OŽ§' 20:31:16 executing program 3: ioctl$VIDIOC_QUERY_EXT_CTRL(0xffffffffffffffff, 0xc0e85667, &(0x7f0000000200)={0x0, 0x2, "d294be2715a8711098744cd2a0f1c0a380cccee459d57eb4aea1198b0b675168"}) syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="8da4363ac0ed02000a0000000001004d010000000000000000007a0000000000fff6f2a2299748aeb81e1b00b10efd9a000001000000000001fffffff60000005f42485266535f4d", 0x23b, 0x10000}], 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) 20:31:16 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:16 executing program 1: r0 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nullb0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2000006, 0x12, r1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_GET(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14, r3, 0xc91add0bf88807dd, 0x0, 0x0, {0xb}}, 0x14}}, 0x0) sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0xe0, r3, 0x4, 0x70bd29, 0x25dfdbfd, {}, [@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, @pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}]}, 0xe0}, 0x1, 0x0, 0x0, 0x40}, 0x1) ioctl(r0, 0xc0844123, &(0x7f0000000040)) [ 372.504951][T12158] BTRFS error (device loop3): superblock checksum mismatch 20:31:16 executing program 1: mkdir(&(0x7f0000000100)='./file0\x00', 0x0) inotify_init() r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa\x00', 0x40, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x101, 0x40) r2 = inotify_add_watch(r1, &(0x7f0000000080)='./file0\x00', 0x60000800) r3 = inotify_init() ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000180)={0x0, 0x8, [0x2, 0x0]}) read(r3, &(0x7f00000004c0)=""/170, 0xaa) inotify_add_watch(r3, &(0x7f0000000000)='./file0\x00', 0x2000000) inotify_rm_watch(r3, r2) [ 372.619798][T12158] BTRFS error (device loop3): open_ctree failed 20:31:16 executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000002a00)={'batadv0\x00', 0x0}) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000002a40)={@rand_addr="8a9acaaadbc108aa9d692b9193ec792f", @initdev={0xfe, 0x88, [], 0x1, 0x0}, @rand_addr="39eb78b0b95007990a4925fa8b7229cc", 0x2, 0x9, 0x6, 0x300, 0x63, 0x40000000, r1}) syz_read_part_table(0x11000000, 0x1, &(0x7f0000000180)=[{&(0x7f0000000040)="0201550000000a000000ff45ac00000000006300080000000000000000400000000063000000e1000000887700720030070063000fffff000000008000da55aa", 0x40, 0x1c0}]) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$9p_virtio(&(0x7f0000000000)='syz\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x29b2008, &(0x7f00000001c0)={'trans=virtio,', {[{@nodevmap='nodevmap'}, {@cache_none='cache=none'}, {@version_9p2000='version=9p2000'}], [{@uid_eq={'uid', 0x3d, r2}}]}}) [ 372.833771][ T33] audit: type=1400 audit(1583267476.899:63): avc: denied { watch } for pid=12169 comm="syz-executor.1" path="/root/syzkaller-testdir977048909/syzkaller.ka0gsc/37/file0" dev="sda1" ino=16613 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=dir permissive=1 20:31:17 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = syz_open_dev$vcsu(&(0x7f00000001c0)='/dev/vcsu#\x00', 0xa853, 0x220602) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x18, 0x1412, 0x400, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x4040}, 0x40080) r2 = getuid() r3 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x9) ioctl$FS_IOC_SETFSLABEL(r3, 0x41009432, &(0x7f0000000580)="7898d34ffa564281772ddbc321c3bd6682b25ee2b5cd9239983d2cb5dfda79fa50903786133a9dac3668f428c4ccaf628a21d8c48789292ffedd2a8d8c08c92d44c7766696552897fe367de708a05bd8843923ba8ec64ac8a723b91102b57d31a5adfcd557aa926fac21a26387158a795f5e44abd2b5f373e8864382aca4ccdb3b62e3853f01b0a95b3522e4a91bc0aed3d360da73c42dce49fd9a5e774081877862a666fea39a394ed2af0960f51ab525cc3a948f1a4301cdacba8cb9dfbcf84c76fff240524b1410b508a49d21dafd4fd6b6634e2188e5262f053a2c7500f79d1155f7eb6d492a6d8849ba4852bfa0e393486827401965a8ca05d18d604c60") setreuid(0xee00, r2) mount$9p_rdma(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x80, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=rdma,port=0x0000000000004e20,uname=/dev/fuse\x00,sq=0x0000000000000d2c,timeout=0x0000000000000200,timeout=0x0000000000000005,timeout=0x00000000000000ba,rq=0x0000000080000000,dont_measure,obj_user=fuse\x00,euid<', @ANYRESDEC=r2, @ANYBLOB="2c617070726169732c7335626a5f757365723d4079650000000000007fff656375726974792c6f621ddd757365723d726f6f746d6fe4652c6d61736b3d4d41595f415050454e442c736d61636b66736465663d776c610500766d6ec2f88be567dd657430656d312c61756469742c00"]) [ 373.137295][T12177] loop3: p1[EZD] p2 p3 p4 [ 373.142646][T12177] loop3: p1 size 11290111 extends beyond EOD, truncated [ 373.153543][T12177] loop3: p2 size 1073741824 extends beyond EOD, truncated [ 373.163012][T12177] loop3: p3 size 1912633224 extends beyond EOD, truncated [ 373.172936][T12177] loop3: p4 size 3657465856 extends beyond EOD, truncated 20:31:17 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x30000) sendmsg$RDMA_NLDEV_CMD_GET(r1, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x1401, 0x400, 0x70bd2c, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x8001}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x40040}, 0x8020) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000280)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$NBD_CLEAR_QUE(r2, 0xab05) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:17 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000240)='.^\x00', 0x0) pwritev(r1, &(0x7f0000000840)=[{&(0x7f0000000500)="3faf8587447a2046075ba777b6d1e049f83acf0389f7b27152504c318e9cfa64f5883e418207aac79d3fe5bbcc49dbf9a975cac5e9e3dd602a1c1944e4909894085d4238761e80b05838c11165fb5bd7eca10e78f820f74c7dffe6b3e9f7875d43188a42eb62ac934e01d26e141e81d737968ed89caedf0ffb181b7702e038ad35a6626f1d6941b40fb9b8d9ea6c8389e1a0656315e4d4ff6ed6bfc1ef43c5259da7ab9428fa173c3ebd2e3b5f348cec65a538248a57a8addf6fb0aab8b65d6171101424796e", 0xc6}, {&(0x7f0000000600)="b87ced334350194ec065ddc21ae9a59747693db050047f24ddbdd793d5550b7f9ad64081ed2196b5962c420e68fd86fdb0beaa78b62f5eb0d883307c806bf8137348b5cb5cb6ba8e360dea4f4b42c191d23d6b4162098724ffb2ee6c560b4240532855d4292522f0909b4490f06e54de26d7345df9fc0b940ba5d6b0b51589", 0x7f}], 0x2, 0xbb) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x0, 0x0, 0x9, 0xc, "a95a8f3b28926fc6073aa20d7beebc68240f000000000000122f1b38e9c9af694c0d435cdf83e9bc09032b000000040d44712e292b00", "8c305bee6fd6000800000000000000000000000000000000008300"}) 20:31:17 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = semget$private(0x0, 0x4, 0x2) semctl$GETALL(r1, 0x0, 0xd, &(0x7f0000000000)=""/61) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0xaf930100, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010001fff0000000000000000000000006c3a61b23153a95b4f69dd2ca95359a104445e14e9269052265b98dcaf6511f4b3713c0b397cc274445c7586cdb56913a5dc154923c980833845873686ec919863082755c62ec771d05415e94e5ca96ef7a1130cf70a634b003256790fefe44c1db0ae2f0173f73db400aef2197b00"/145, @ANYRES32=0x0, @ANYBLOB="ff7f470900000000140012800a00010076786c616e0000000400028008000a0036459cdb26cd03ccb7e638a66c8602005e05e1737efa8d3181ce42849497b074c8e47f75a9793acbd2a0f91cf7ba8571096382df1b166a1ac2ab2863a703699433042cb8de1b562f0f55fd291ee26309d9cca2bc6d9bf27b77215ee686799a2fb430ac49e8b172a779df69476ce56a2d6295e8f7f23413bb57090823877b7e4299ca21cd8ee27360fd41a4674c4daa19f706b8e1dda086c85d55b4ae3f04cfe7414eb600000000000000000000400659b7b146873dbd6845e76687fc730d891b00d3ca3b2b2736790a79c56d535ac3c22e1e101983aa6be1e224ec0f958a8ee28ad04deaee850534bba097a7639e5a9904fd819082404d", @ANYRES32, @ANYBLOB="ae0e3f5e9198ea5bc0a5796bc26ad49c341715cf8a05c97c3b622643c87421c43c9861be6566cdc1e133e2fd853386dba2eb4c22b08fac46e50e776b2deceafa446aafc47a00fd753af52816820d42c33e5d43d6d80908ee09c2c454e77efe730b99dc651551e42e705f71e66f"], 0x3c}, 0x1, 0x8000a0ffffffff}, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080)='NLBL_MGMT\x00') r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) r5 = pidfd_getfd(r4, 0xffffffffffffffff, 0x0) bind$rose(r5, &(0x7f00000001c0)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c) sendmsg$NLBL_MGMT_C_VERSION(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r3, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x9}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}]}, 0x30}, 0x1, 0x0, 0x0, 0x81}, 0x80) [ 373.764197][T12198] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. 20:31:17 executing program 1: creat(&(0x7f0000000100)='./file0\x00', 0x0) syz_mount_image$bfs(&(0x7f0000000000)='bfs\x00', &(0x7f00000000c0)='./file0\x00', 0x80000004, 0x1, &(0x7f0000000140)=[{&(0x7f0000000180)="cefaad1bb83c000007dc", 0xa}], 0x2228c11, 0x0) [ 373.805300][T12199] Dev loop0: unable to read RDB block 1 [ 373.811208][T12199] loop0: unable to read partition table [ 373.817724][T12199] loop0: partition table beyond EOD, truncated [ 373.824086][T12199] loop_reread_partitions: partition scan of loop0 (©Z;(’oÆ:¢ {î¼h$) failed (rc=-5) 20:31:17 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="76696e8c0b13fe975d0168b61759a7", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 373.914964][T12198] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.2'. [ 374.073804][T12211] Dev loop0: unable to read RDB block 1 [ 374.079614][T12211] loop0: unable to read partition table [ 374.085644][T12211] loop0: partition table beyond EOD, truncated [ 374.092008][T12211] loop_reread_partitions: partition scan of loop0 (©Z;(’oÆ:¢ {î¼h$) failed (rc=-5) 20:31:18 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r1, 0x8983, &(0x7f0000000000)={0x8, 'veth0_macvtap\x00', {'batadv_slave_1\x00'}, 0x3000}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6gre={{0xb, 0x1, 'ip6gre\x00'}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_TTL={0x5}, @IFLA_GRE_ENCAP_LIMIT={0x5}]}}}]}, 0x44}}, 0x0) 20:31:18 executing program 3: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0xc9, &(0x7f0000000080)={0x0, 0xffffffffffffff7c}}, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(r0, 0xc0406619, &(0x7f0000000040)={{0x3, 0x0, @descriptor="d97d54069a563cca"}}) writev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f00000000c0)="390000001000090468fe07002b0000000100ff0714000000450001070300001419001a00", 0x24}], 0x1) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000000)={0x4}, 0x10) write(0xffffffffffffffff, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000000000000000", 0x19) sendmmsg$alg(r1, &(0x7f0000000140), 0xcc, 0x0) 20:31:18 executing program 4: r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f0000000000)={0x2, 0x0, [{0xc0000000, 0x9, 0x4, 0x4fe, 0x80000000}, {0x0, 0xfd8, 0x5, 0x31, 0x3}]}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x20000, 0x0) ioctl$SIOCAX25CTLCON(r1, 0x89e8, &(0x7f0000000080)={@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, 0x1060803f, 0x8, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @null, @null, @null]}) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000100)={0x1000, 0x8ba, 0x2, 0x0, 0x3, [{0x662, 0x5, 0x1, [], 0x3200}, {0x7fff, 0x6dd4, 0x2b5, [], 0x400}, {0x6, 0xfffffffffffffff7, 0x6, [], 0x800}]}) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r0, 0x110, 0x4, &(0x7f0000000200), 0x4) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/asound/seq/clients\x00', 0x0, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r2, 0x11, 0x1, &(0x7f0000000280)=""/136, &(0x7f0000000340)=0x88) ioctl$TCGETS(r2, 0x5401, &(0x7f0000000380)) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f00000003c0)={0x1336, 0x6, 0x3, "04e4c112cc81e44d2fb15059c88c5310f080ef3d2d14c7061da9d2e5cdbe178e", 0x34343452}) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0xffffffffffffffff, 0x400, 0x8}, 0xc) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000004c0)='NLBL_CIPSOv4\x00') sendmsg$NLBL_CIPSOV4_C_ADD(r4, &(0x7f0000000780)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000740)={&(0x7f0000000500)={0x22c, r5, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0x178, 0xc, 0x0, 0x1, [{0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3222165a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5abb93b0}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbe22}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x23abf4ae}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdfd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdac6}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3000374e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb5c4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbc62}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5260b178}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x529a}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xcdd2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x71f1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x31bae28f}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd3a3}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6e0599fb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4396}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa1ab}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6b40af6}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7e12169a}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb5a2}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3ddd53ce}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x718b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6ffb7436}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x20b59b97}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x642f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1506}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdaeb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x14a}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x97fb}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2613}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x50b0d298}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x57e9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x8ae7}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1202ad95}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3280}]}, {0x34, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf335}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x17e59364}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x46ff18f4}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd4be}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5a8d0ba0}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x87f}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x14, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x6}]}, @NLBL_CIPSOV4_A_MLSLVLLST={0x7c, 0x8, 0x0, 0x1, [{0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2b2dbf0}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x49}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2fdf1cae}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f23b58d}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x525dcb83}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b228b27}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x5c}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x430ea31f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xad}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7c85b751}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7d890ce1}]}]}]}, 0x22c}, 0x1, 0x0, 0x0, 0x20001}, 0x40010) ioctl$SNDCTL_DSP_GETFMTS(r0, 0x8004500b, &(0x7f00000007c0)=0x2) r6 = accept4$unix(0xffffffffffffffff, &(0x7f0000000800)=@abs, &(0x7f0000000880)=0x6e, 0x80800) ioctl$FS_IOC_FSGETXATTR(r6, 0x801c581f, &(0x7f00000008c0)={0xc5a4, 0x54, 0x3, 0x2, 0x1}) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185647, &(0x7f0000000940)={0x9d0000, 0x1, 0xe0, 0xffffffffffffffff, 0x0, &(0x7f0000000900)={0x9909de, 0xb06, [], @value64=0x4a3}}) ioctl$UI_SET_RELBIT(r7, 0x40045566, 0xa) recvmsg$kcm(r7, &(0x7f0000001d00)={0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000980)=""/198, 0xc6}, {&(0x7f0000000a80)=""/102, 0x66}, {&(0x7f0000000b00)=""/177, 0xb1}, {&(0x7f0000000bc0)=""/214, 0xd6}], 0x4, &(0x7f0000000d00)=""/4096, 0x1000}, 0x40) r8 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000001d40)='/selinux/avc/cache_stats\x00', 0x0, 0x0) sendmsg$nfc_llcp(r8, &(0x7f0000003180)={&(0x7f0000001d80)={0x27, 0x1, 0x0, 0x2, 0xda, 0x40, "93ccd2b7587720270df5e7ca0fc13e31098482f3902c56c22a36c4e3b41525d9d0063830281cd8294cb08197bb839b4d8d3839c25a3a5d1b7c440e182209c4", 0x9}, 0x58, &(0x7f0000003140)=[{&(0x7f0000001e00)="d0d3c085f022838d8d3282f3c6c8c3b4417458d418de25b29ce8b7d59cec8103228a7e6e6d4c3a58effff221dc1f64149f60ef547342e4824e911bb8ac46d9f5c4da9f5cfaea9bfd21ab6b9b5b431fa8f2220d6543c4de439598d419acf188c7925d1265eebd7fc9e2201049af738e22a5ee0d73428a853c6dc1b3115349d5a6954ee417311259e826308ef10da172d14e3d00742db73462aba4ff4c9e021f3ad8e6758cd765b8f48b64468a3fd52e4bd6d27f780abed879fbbeb5f96afe0b7593adbdaf25ddd07cfcfd67838c4f49ca467b01db", 0xd4}, {&(0x7f0000001f00)="59ec46bf5a9e0728ec262d968b77d6f2afe1ff81c00808587ff77b165b602e3120d5bd7559c7f66a22fe6dcddc95ebb16e848039f18782bf1c3eaee141dd18f021a70d56bd98c9454d2fdb2a59fa15d9108b6f0fd2d9945c0bfb2235cc202851e6ea35c38a4209a2ad7a6857d6e6d5885d64ae6013640c355c26ef57fa09fb5a066a55ba287764dd4f426ccf4d00b45303de1d30b8d5de3dbb733a197c3fe868de037ae14b3adadcc179363ed6b2b0084ef4d5bc07ee700d0bec1ca7bea05a37b6538da86d3e6a33ec0e148f0248ad67a761a1470d32", 0xd6}, {&(0x7f0000002000)="32311b9b41777667180703409126a6282c3cfde45520abbb6f6cc3e8a98e2675aa6d73c5838be3b12dba0c3ef35856d0880d2bddf8ddad92fc424f38596d4084e4479f7dda1cecc15841c1731be0708879632925de52f00b2185e8c3f4c325f44b913aa093ed62d195927620bc9643fe4d483364356d4447e3d2441ba04dde6b26ffe1638a2232b13ad71f91699518f759885b6e8f7a63af016779d1a26512676bed8a1e6cd1b91b5e686bd86cb0e1062fe775481c8d89e838ed4881f13a181fc49a40e72b2667f0ec95f2cda457e25f46f1a987c9794057ddf59cbe6b9eef7c22698ab118973356df108d694ec766d2e58b79a2a83b585962be2903b15e12250e1c79d2c627f0fc3f36baf4ffba6d765845960a59c14059882950b3b420494c1739af406fdb5c187d237e16327e34bcc48f85a5d8dd7409e2bcac19df6629a50d888258952d3f5836fb8fee3a78a7186a59d376e3921077269ecb00484a2c465af8dc34e3b6cbebc9d67e53c1ff39b9a108415f7e64695fcffd16027005608a794e23581d0bc6308da32ce223c9390498bd8a593a7cd213b1bb982799c2140f736fe3bc9dc09b386c76c041c80c8810d438c920091e3f3e9c975af25a2ccc1fb5112852600dae30f58faae04a378747faeef43bfd0436f25ffb68cc620063dd827bbdcab01a5f2b8da17fdec70e4c69e4793f7086a1f597054023f27684248dc13d85829d0342c2ae1ce7a0688fad5591dd6979871a2ace1970ee90d33c76e0b071c2d5f3c19f43d46a758b8d91e2c382551062f0772951ed3a2a6c87408a20d96b4d25000f94c7978a2aea83125238b99d8bca05fcd4a0f97e09c1941e72da4a86f515ed59fa297e29de5c27ef73588358dd31548f723a588dbf27e1e875e42715cdc5eb61159719dc3c0a5ac6d6e998a42c1c35ca9dc373dddc8550634d1d4c383a6575263e2a54722eb408094a8e739c94c20e8dcbbdbe5539b405ed01d3a20ed95d0d6cf0d5d112b816889d2b1a67e8765dbfa555920239ab4a2d28a2ae46dc527f5e2fb671ca7e8cd1627af8bc65dee94d4513c9609207732243d975b7576f98ac413fbc54ff701890a2578b53743685a20f26eb7aaff69dd8db80ae71f0d2c5949fee0a17630c3e93e7b59cbcd25af98b4f34197d387028e0297d0d042c0d0628fa23ce09617aa37934ed126fab520df5615869f686c18edb4996386054326f51f1f5f914d7b473087c0194ca1fe1904ed72db38352cedc927d713b8a9133984d0db1a7ef5dd6a3f2a615a53973acbba5a25f6bf854c5f51b70846be3721afdc1497423d4bf03cc17fef77cb8771fae1ef7869d64c81f7376fe3450a4874fd07878da7895943ca8fbb33fa7a3dbe36e57c277cbbfd3e715281ce928a4698b41936886d6e2362f1cce14672d3b6bd1358cfc3043672c63a62594768a6b2c499b860de04b36d752483b2fcbea4af0218fa2ca817e59eb596372bd6f7640659c88e6b0be57e1095ad6e70f63c8a960e50dc299d6e16912ccd9a0944b931f389024a9a5ae5fa61fb84eefef76e7f17e6c7d8ccaefbbd349856c1afd587bd4ac30d5abf8a31a17136d62f66af7ecca3dbdabf76b1cc41384c6454644f2e2453ce1b7840f777187edc75a6a235f34bedfa29589c43702942a88432a3330367ea5c0d2bbb5372702827eb0792ec2bc2581fde503bd1d151d53c8c4603571d1c63e6d359c78f2b01c8ea77c9b66718cd3fd64812407eb14d122546489e42923ceb8a9a85ab9d70fe59b0ff170eff2d2c04995a7775e064a4abf12b56c3261857973a636abb33a5a98d95a17af2fdf05fd08c00ba913d99e0a8b11074e29309f8c59c97f9c0eba564f6ca370eb10e889de29dbfa488b05505a1ab4a50410b2110f86b3646cf24f47ace89f9e3b1b8d07f9fd21dd69bd6e0ff2ae92db92c9652d3e601718bfcc8743ba4462150f7188abef0a32d3e5d1e41dca0db1463d761969dc9d02524ae57633281fc2592cfce1afb5a0366c06b828f5aaf715a883e7316460cbe6cb8fad9240640fcd01771846a0e2d1b2b533131e2eadc41059fa0f67221157f14fd6f9b731edd2c6d04062ca3cf0a7cfbb0dca2b7503eb6a3afa0ca1fc1e0695b18ed5aedb72a8c6460a9f8962967b734f4bba24cf63ab912b62f45bd645da4656f0ec82da094d8c29b463ae19fc9922c42e32519f22b74cd115e37f848c4dd83984848c6e3246330dbb8dd0d37b6fc8214114da7a293781cc8dd5388df26a6b6f63cf62e786893783b96b3ded7ce0bb40609c35b6730f8fc532b1a5f9334298a8ea4a09a5e645f6cd0a5eb3af1e5fefb9e2404be02f14a7d5d27fe8c9118c931983a329c52725e49956a03fc2c9c1aac5eb21c7df46f4f963ee788f00e745c5e011b418cf1463450598face22e2cd4873957f68668ae97ce8ffd0931a4d13a65daed72e35411a2606c4f1fb3160ce03e8baf3bdcab6b3170c1533441079d25e53cb843bb263cb45d55d59405fdbc09c1e76c5d84305faebf17a3bd50808564d2e0483e22752e15b0a5924b1805842bf4a140d01a02ed211ec5f2535755869cebe3c21e26e2dc934e73787705381f1cffd4070985d9186aabdf1e4b09f8c241822da1924bf163929f2bb80a8f8d68811e2ce6919aca7983fa3b51af0b761231767f39af6cd90ce263ef411b6a301f44e42bcc3e81331f84c44f63bfd3f08e8df8cc79d979a4cd38593e5bb09c7f2ed86dba488f483e0dccae9a908b24e487d2517b73a6873c8e592347e7b7f88fe09222f9d80c30a7da63ed8cffd280d83f9e508401cc222abedfe8c5a877c83257fe68b2f92f5f943f261637ddd5ad8ce63204ecd3026e5ea790c4409f7e3fab0b03e650cf379e5a97974c9bd8fbea02ac28b2ccc09063c53d3fc630ac0dcb7d9ba0c814223b18feb633b551ac047c2d749919643cb3fee72f4a2524e2962251d2825db886797e65998032ef3d9838f5a16a25dd3ef4b0b0558cdb55c7a47461bff7364ddffe9876aa7648be71656edd31dde02ce514423f933c2f3076434ed5083e74699453a1985dda03c21749543f0d92ed3c648321b59640507d1c70f78afd00920a1a117c1d2ce9f12691e48fc315d5deaab076f7a0d175f8354e7f62e2f04bd86b3ecf1db8257aac4e62374b3cb96b20c79a626aa4f7474493682ad466d72b2c8498bfcf13752c2d10b42508d0fb898692f58571c1e288bb704bca0249979280b6f95106cd9e3dcfbbc98f7cb3f7690501924c38e48ef7e0cc38cb1a16e733521ab34709126d0bbfb339ddb29ca7f18bb587059f2aa116aff4716f2a791db314c8a0095f5a18901b8869339dbf87c7cf060c419fab19f6d618833395f50f6351923ac335005f14947f131824f9d682e78e7bf263b69c6b2beaf9896ae309367f310d0f172f50b2021183cd98d571f4123677cb367e3b9c4d8c392c71634c0d76f435fa6c4a10421f6eb82679b9dc7f3e439c5612dfafbc05b9211171e8443402b54c4b317134cbb159e459f5752466cb121a9ba81aaa9959ed69dc776a81ad96ed062b957a39bb86b8534c2b52e4cfe7a65e02649c4bce6a88c150a437b96943df123dc37f9e81135c0b60be8a1bf90df46d708d9526c175a773b21f5d561a52ed1dd2e403587c74e09eb99349b547b753d6e571b7f245c1582af2100a9b00b474d4d6a9de50c75e8dda1eec00bb129ff7db1e67f6eaecd0aaf698dea8b36e188e4daaac27325692bf146d46421dc2301232ae8872401555307cde95b09a9e9709c984f119fa41ccc7ef75b6ef7c22aaabf4fbf6367975e6e4b7a62f7b67cfbca8bfe630cffe7e8b8b14721222dd71dab5e8f6aab1c6eba7d7133c9829b112cd1e3224ccbd45f86a771e9feea3b63460e7c98e7ad4bd63fc279d332efda398c05f65bc23f5e4ae5b7136ce0b850d6eea0b7037d13bba9a38a3294ad7186386da01c7ca2f81764cf4fc6d4113ca1d8814044619ee94f586c661db6e53aed5f4643cc37b38b31fc31fd7eecefed8c876e1ed5f7887eb4a9d0fed1b63207a74d1cc5003a5f8e6e41f66858d33d31b9411a3a9fa56988c571c379a47dc5883a33bd98948e1ebf624baa8aa2a734cc601c87fbada768f2b1f2312cb7a2e743d757fdce3593bc0e57dffd88f1e3f6b4db216441e1f68bfa2309a463e3719fec49290eb4ab544560ed6850e40285565a73326c5b8ea4f814ac6d4870eceba6721963f0415792e0709d65b5abaff38266eaca8a13910a5eb591871d364008982f7ea35656de6d0bdcb96bf758ff5360890f1c5df482a9c3a5f92322a94ada831478274531ff5ec71f17dd9f8e0d9a304a397a1da6657daa9df3d8bf6161ddf3957fe103d504f879b1350a6e0aabbc0e3780591067ed86b95d34c79b079b4562970765f63f818f4f2b1a6d145532936c6153a6c882a62683244b55e9837d6217b8c74e7f0c5e7bdd6371d7a7842faf666748cb1204709c67702c7aa521c5c49c092e054b58d8dce89d7a79403b1851d7829753cc3a3c8dae3b33b4f57f3812e39f65e669b28f4b93700698f18105d232aa9e73288c6691d4b40fbb72004d8f6fe29155bb503538676c3a15993ab7c14fc84e3c64136c40190472f2b9bd79994f8c10d43b26ace11bfd5aae549c2d9b7790f1a84e15a69dd1727417da42d2624b17060ae7e8f2e6b6c28ce1dcd4f06cfdb0eb96d3a4c16a0ae38dd25b11c1d61ccc5b654c01c9b2497ffc797f314b5fc82ff8c6f0806deca5c48874cde8dedeace9710d5f07c3b0c618a81a7eae747bfeb26ef506ae42ffa20ad4bdf847eadf05f39ac046e5ff481f9a891aa4af588f9eb890488ec46dfc652dbbdd3dc43b15ea53c78f0edf3c2428986d5d78240db5b128919c242050615a9c474a7711f24b587fd0b418cd759c1b1d7c2a1c4d5376439de17f210958f9d459e2ca1196ffca5b6cdd5b0cbc1a845137ffb94515a7825cd0fe195069f89e2b195e6c4250dc9f05271f4c0b9aa7284e71e46f7baaa06f4d2bae75161d1c37db3e07fe11370dcc87c1b9ff5df96aecfebedac5fbdcc829bdbe4a7266768debfb6230d552c9bf97de1614dcd72a36a1daa749437d0b04443d0797e579dd0b2868db061ab0c03ae38e46d24f1dcfee79c95f307fcdcd3b3e68bb06ce01e2b18656bf3bcbc4c989f78f76dab327050c0a1ebae8744c05e11b2a3f6eb767ab62a9e51272487c058d4b241e9a941e93bce7ae9a372ae8e880494c6aadd8f7fc65f5825d5f0864136a704db98e88dca6af9f8c750a5ba0a9a55facab259936bff4f8c1677266ad9ab06a2e0bec618b8085365c4530894e41466532a437f0607c5982f47db2a5db0bd9448c8ad549722945e03ca5929ea75ba1b4229c7bec86482756648225d9efb3bd840fb3111728a568b0a8e1d7f98017093f772535e18bc38b3fa00e794cc5496b370b4e1405c39caef5573578c910098b0f5f2c5278f0446a50a54d990300f7a554d04ddbd20c25be2725c2895ab6dd5bb27480ef2064c46cc0ec3e760ac2a02f87566ec6edb7f3c86749e3a118a0b43586a87b0cad58e87016eeac8c44850ddcfde886a4bab8315eab28e28cf27ac765557b1ce48a158b7f62ac360f0512c6c72d33bd770cdfbaac2b0e2a78deb7d98e6822bbaf94361fa551aa613202a28b89aa53476c6c7e360713924a81171606294e23bf547a25f97dea6318236d4e895630b9f93346cf9ca0811a61da2ac9e9c08b6c1d27fa6ac28aa07d83f00ab09aa6f933f35094b9fbe44373e1ac4126422a0121f132", 0x1000}, {&(0x7f0000003000)="9e3c098babe88f7fe265ac5581419ea648dc769fc8be626dcbc8070a68646ebb3bda0fb5a1ba1aeda990367e785d12976db9c18abc14aea167f37f7fc3f1ef295d9a662dc09b91c4aae3742d7f4d1acfb06b7ec60371e68ac9ec46a0e02c6345dfc3ca79b9f3e15f4c139cbc57e4d78f8a4bbe38ef0a4f8a5219057f6c1e98c4", 0x80}, {&(0x7f0000003080)="2ffc3cb2b5abf49b4e6b015a030549c1dcb6dcd24e052fe8398c79ee904003eb4af63ca740d01edffc6fd69a4329c40c93d67e0884a7b4eac1fed417e1dfed250593fe1da3524d6dbd53720ee2e12b849b420c56cfd2a29b66d12a43359223df7a6a3f3d34590d44fba503a11962171587df91b455f953a5598c8753aef4a6aae6475adcd7ad", 0x86}], 0x5, 0x0, 0x0, 0x24008000}, 0x4000004) syz_mount_image$hfsplus(&(0x7f00000031c0)='hfsplus\x00', &(0x7f0000003200)='./file0\x00', 0x8, 0x6, &(0x7f0000003600)=[{&(0x7f0000003240), 0x0, 0x5c}, {&(0x7f0000003280)="a1cb2cb26bffa53aeed13be763abc86b2576a69196eb9658d9057b3d2640b29b032209a90f0b10a50e517af813c9bb51c2d43b5aa5a4c8123b36f84243c9fd6c6fab40ef34482842df3098583bf001f4df2266e052784357eb7f881089b31a0e671f748b6fd0c5c6c3f18738e6797c01d55b9daf26446db6f889e68d6296f1ddc7789aeca9c8bf0b5a177198d75b8ce4818f3a8e7cb705758d08d0b2f80ec583f8cd6a524868fe8d458d6294a054d31dfc05601372b1e4f061a14e", 0xbb, 0x80000001}, {&(0x7f0000003340)="90dc22466b0d78478a811c3d004c9a11c50bbd5ac187f02cfd5d600525d017618878b831901a12a6a7628380079d0e3c2b157f5e79439e34530e8d8ac71e757ad8be9d175419fb71ac05e4bcb5d5be7d4624fb8a7d61b2e8298aeef26c4768d9c5b76c3595e2902725b6c09400b0778aeaadb1598285f042b77537871acadea3be145f04ec4aec9afc5db6a6fca62ab94d47df96fba1ba556ce99268e75ea129d241a1a0f151ac49ab1b77c4f1dc4df4d8899f763242b88baacc0446ee1bfb7ddb8a894c7ac2039f8044f63df06435f2d081574956184f61a326e6defd860ea6ad157b5e3b1438cdeeaac37177941bd653a26c", 0xf3}, {&(0x7f0000003440)="a3d94ce53fed8c614125f34deb44930162e9eb7c7839ca2b204c0b77a04ec69206c4f1ea0e99e6ddec9d48e78c832a1a00b353938e6bd4965a995c15b554b2fd325523a204df676e4b118258be09749143e6980b1a1b7e79d7ff2f69a0da02605bdd105a2f4b0599d2f0302848fa4305619b", 0x72, 0x100}, {&(0x7f00000034c0)="181ca5214f8da4a90994bd6da8a5da96dcae36e681b1e8df6ca8327d4cc8fb7b6dec41e312195772295895b8f382ce", 0x2f, 0x89}, {&(0x7f0000003500)="8df03815699a7ba66d8ed38a5eb77be7fa855d00e92faec7ac3bcc55651ec61a2975a122a49cc483730447697eb165e83053693af9c33679ef708a52a41bc5016467601ff06c66ddc424c18008b82b90ec1f8aa7196930f55f3f4f92ed747934e9946531f91839afdada4eda85de29618668220189367a647c1078aa527787532c798b51eb5379a618998592f09df980bee5d7d4d224a026bfa955a9861a2e5b83b576914c5eadb3d0b0172a8d5ee06262ffaaf8a1c0430da7b02a5c1f9e5b2aab6cf456c3f4947721544557a40b876c63dbdd3250aaee3d42bec308a4cf94", 0xdf, 0x2}], 0x200000, &(0x7f0000003680)={[{@type={'type', 0x3d, "54e680f0"}}, {@nodecompose='nodecompose'}, {@nobarrier='nobarrier'}, {@creator={'creator', 0x3d, "cfce2d30"}}], [{@smackfshat={'smackfshat', 0x3d, '/dev/dlm-control\x00'}}, {@subj_type={'subj_type', 0x3d, 'trusted'}}, {@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@appraise_type='appraise_type=imasig'}, {@smackfsroot={'smackfsroot', 0x3d, '/dev/dlm-control\x00'}}]}) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000003740)='/selinux/status\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000003780)={0xffffffffffffffff}) setsockopt$netlink_NETLINK_NO_ENOBUFS(r9, 0x10e, 0x5, &(0x7f00000037c0)=0x6, 0x4) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS_OLD(r4, 0xc0fc4111, &(0x7f0000003800)={0xd4, [0x7fffffff, 0xfffffffd, 0x2], [{0x9d8, 0x5, 0x0, 0x1, 0x1}, {0x40, 0x3, 0x1, 0x0, 0x1, 0x1}, {0x8001, 0x5, 0x0, 0x1}, {0x2, 0x200, 0x1, 0x1, 0x1}, {0x8, 0xfff, 0x1}, {0x6, 0x6, 0x1, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x0, 0x1, 0x1}, {0x0, 0x405, 0x0, 0x0, 0x0, 0x1}, {0x9, 0x6, 0x0, 0x0, 0x1, 0x1}, {0x7, 0x9cec, 0x0, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x0, 0x1}, {0x9, 0x2, 0x1}], 0xffffffe1}) bind$l2tp6(r0, &(0x7f0000003900)={0xa, 0x0, 0x20, @mcast2, 0xfff}, 0x20) [ 374.404845][T12223] fuse: Unknown parameter 'vinŒ þ—]h¶Y§0x0000000000000003' [ 374.503239][T12226] fuse: Unknown parameter 'vinŒ þ—]h¶Y§0x0000000000000003' 20:31:18 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) ioctl$CAPI_SET_FLAGS(0xffffffffffffffff, 0x80044324, &(0x7f00000000c0)) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f0000000000)={{0x8}}) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) 20:31:18 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:18 executing program 2: r0 = socket(0x15, 0x80005, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) r1 = socket(0x2000010000000015, 0x5, 0x0) getsockopt(r1, 0x114, 0x2716, &(0x7f0000af0fe7)=""/13, &(0x7f0000000040)=0xf0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4}, 0x20) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000000c0)={r4, 0x7}, 0x8) getsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000000), &(0x7f0000000080)=0x4) 20:31:18 executing program 3: syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f00000003c0)='./file0\x00', 0xffffffff, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d0066732e666174000404256a0200027400f801", 0x17}], 0x0, &(0x7f0000000080)={[{@fat=@discard='discard'}]}) lsetxattr$trusted_overlay_nlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U+', 0x7}, 0x16, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x8181, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000200)={0x3ff, 0xffffffff, 0x1, 0x7, 0x80000000}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) linkat(r0, &(0x7f0000000180)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x0) socket$inet_smc(0x2b, 0x1, 0x0) 20:31:19 executing program 1: r0 = socket$inet(0x10, 0x2, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000017c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001840)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x24, r2, 0x20, 0x70bd2c, 0x25dfdbfd, {{}, {}, {0x8, 0x2, 0x1000}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000140)=@v2, 0x18, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) ioctl$FIGETBSZ(r4, 0x2, &(0x7f0000000240)) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) ioctl$VIDIOC_G_STD(r3, 0x80085617, &(0x7f0000000040)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) sendmsg$IPSET_CMD_LIST(r5, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x64, 0x7, 0x6, 0x301, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x80000000}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x40080}, 0x40050) 20:31:19 executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000080)={0x0, 0x30000000}, 0x8) mkdir(&(0x7f0000000100)='./file0\x00', 0xa3) openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x101a00) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:19 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000000500090300000000603310006e617400"/36, @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRES32=r0, @ANYRES32=r1, @ANYRES16=r2, @ANYBLOB="7d9589ac70c3af7844d58ebca65e4849a55fc2d80ef610707846656d5733e05f889373eb4afc044ef27de40494e4a63745b791d27c30ceddb172885fca063aeece03afce3b1c1ac73eb1494d98cb35c7c260407baf61f71f7edb2ed2ceb24c37eabade392a3bfaa53c6dcc4bc6d06041331058840383d4cebee336d1f3c39d42856ad3a650bdc452ce59238a3f73207b7d3ff50ecac96265a9ac5057fc9556f65d530d31ff5682e15e734e9ccc93ed8ee3716e8493a9f225c431997de2d18c05426927d131c0d090514837f15679d5f04e84a70b204e91d80f87b675b4", @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRES32, @ANYRES16=r0, @ANYRES16], @ANYPTR, @ANYRESOCT=r3], @ANYBLOB="b08f210d2083b2aef614295d482e7624be", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYRES16=0x0]], 0x4}}, 0x0) [ 375.486053][T12258] fuse: Bad value for 'fd' [ 375.499018][T12259] fuse: Bad value for 'fd' [ 375.580975][T12260] IPVS: ftp: loaded support on port[0] = 21 20:31:19 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="009b1e93360de2898da74cedd9000000000038d3b5bd8e3991f97215895537af0517e09ca29c3c8d79210fa434d4ee88db59e4a60ebfa3d41364c9f4e5cb527a881c8b728ba9478ff879b251b04c83a28cd6d1ae534d2c6ed13d0508ef1876cda04244ea7b1251c032c9", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000080), &(0x7f0000000180)) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dlm-monitor\x00', 0x400000, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400)='nl80211\x00') r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYRESOCT=r4, @ANYRES16=r3, @ANYBLOB="00022dbd7802fcdbdf25d50a0000"], 0x3}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) stat(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000300)) r5 = getuid() syz_extract_tcp_res(&(0x7f0000000440), 0x8, 0x14000) setreuid(0xee00, r5) setresuid(r5, 0x0, r1) 20:31:19 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$dupfd(r1, 0x0, r0) pipe(&(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000380)) r4 = dup(0xffffffffffffffff) setsockopt$packet_int(r4, 0x107, 0x0, 0x0, 0x0) r5 = getpid() rt_sigqueueinfo(r5, 0x7, &(0x7f00000001c0)={0x3b, 0x1, 0x1}) getpgid(0x0) syz_open_dev$sndseq(0x0, 0x0, 0x1) ppoll(&(0x7f0000000200), 0x0, &(0x7f0000000280), 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) perf_event_open(&(0x7f000001d000)={0x4, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp, 0x0, 0x4000000000, 0x0, 0xa, 0xffffffffffffffff, 0x0, 0x3}, 0x0, 0x400008, r2, 0x0) io_setup(0x6, &(0x7f0000000100)=0x0) r7 = socket$packet(0x11, 0x2, 0x300) bind$l2tp6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x6cc, @empty, 0xffffffff, 0x1}, 0x20) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r8, 0x0, 0x0}, 0x20) getsockopt$packet_int(r4, 0x107, 0xb, &(0x7f0000000300), &(0x7f00000002c0)=0x4) ftruncate(r7, 0x1f80000000000000) r9 = memfd_create(&(0x7f0000000ac0)='\x03\x11&\xe8\\\x19\xd8\x87o\xb0i\xddi_t-\xfc\xd7\xa8\x9a1{-\xbf!\xd9\xfe\xce\x85\xd6\x9cY\xf4o\xef\x90\xcf\xce\xe7\xfa\xce\xb0\xa02\x19\x93\x1a%CZ\xca\x81\x00\\\x1d\x1c)42\xb2\xdd\xd1\x87|\xe1X\x1abq\xedo\xa2+z\xf6i$\x84s\xd2e\x05\x00\xd1g\x93\xaf7\x17\xfa\x10\x99\x87\xce\xd5Q\xab;OOPr:i\xd2\xb3-i\x00\xbc\x19M\"\xd5s\x85\xa7Bo|\x95\xd0\xbc\xbc-\x80lS\t-H\x86Y\xe2\xde\xd4K\\\x1dF\x87b\xf2y=\f\x12\x8aw\xfc\x17\xa69/w\xeaH\x80\x90.\xf4\xbf:\x95!RO\x0f\xf3\x02\x01\xa0)\vL/\x81Zo\x0e\v<\xf1_\xd3\xde\x0eB\x01\x8f~\x1f\\@DW/\x02\x8a\xaf\xad\xb2=7\xfc\x8b\x1a\x8b\x15\xc0\xfc2\x0eI1Iv\xc9f\x8b\xc5M\xaf\xdf#H\x02\xc6\xa0\x92\x80\x14:\xa9\x82\a\xc6+Z\xea\xa4m\xabL\xb1\x15)\xd4<\xe5\xe4x&\x84\xa3\n\xca\xaey\x87\xf5\xb3<\x8c\xeb\xbe0\xe9\xe7\xbau\x9b\xf5\xcb\xc8\xfb\x97\xca\xa5\xe0J,\xa0\xef\xe7\xe2\x96\xba\a\xb8\x19\x9d\xd4\xf6\xe7\"\xea7\x06\xa7o\xadB\x05\xdb\x11\xc7\xbcM\xab2\x87\xa8F\x19p\xeb#a;g\x8cyn\xfb3\x95x\xee7\xf7\x02Q$\xfc\x86\xd4\x8cy\x0f\x1b\x1e\xb5\xcf\xd4\xa9\xba\xe4L\xf9\xee\xb3;TP:,\xa8*Z,Du\a\x99\xfb*\x9d\x9a\xed\xd4t\xf4\xad\xf8\x8dj\xfd\xe2\x1e)3>.;\xf8\x16\xed\xdbJ\xd1\x84K\xe6(jA\x15\x88\xeb]\x82\x85\x0f\xac\xf3\x12}pi\x0f\xe2d\x9e\x0f\\\n\b\x19\x8c!\xc1b\x1c\x15\x89\x1e\x87\xd0\xd6\xef\x05,WI\xce]\xdc\xb3N;:\xd3\xe3\xe3\x02\xc8\xf1\xa6\x92\x06S\x81\xc2\x99\x9eU\xd3\x15R\x1d\a \x0e\x12f\x04\x83?\x96\x18s\x80xw\x99\xcb\x87\x1dj+mp\x18|\xbe;\x12\'y\xc1\x17\xda\x8eb\'\xbel\xe4\xe3\xdaM\a\"|\xe3\xbd|LRk\x01\x1a\x17\x81\xe2\x87k\xe8\xf2\x90\xb4\xe8\xf2\xb3V\x15\xce\xc8NqRJ\x05\xd6tm\xff\b@\xb4\x05\x93\xc7\xcf\xb7M\x13\x96_m0|\x9f\x93\xd6\xe6\xd1\xaa\x1b1\xed\xbfAzI\xb5\xbf\x02\xe59\xb2\xb4\xed\x1a\xab\xe2\x1eS\xd5N0\x9c\x00\xd66fD\xd4\xcbO2v\xa0\xa4\xc8\xf2\\\xee\xa0\xcc\xbf9\xe1\xad\x82\x86\x83\xe7\xac\xaf\xdc\xb5\x04\x80\xe4k\x9dZ\x92i\xa7P\x8b\xe7\x03q.\xff?\xa3\x1e\x97\x9cW\x17ipm>(\x8d\xf8\xf9\xa4\xb4.\x0f\xaeM\x9c\x99\x81\x14\xbf\xbb\xae\xc2:\x1f1\x95%\x96\x86Y\xa8\xab\x85Y)\x85v\x1e\xe9B\xc2IF/9\xa4B\xec\xcc\x9e\xd1\xf8\xeaN\x01\xe0t$SW\xe1\x15\xe5\x1c\xb3,-\x98\xdb\x97\xbc\xf0\xf8[&\x8f\x11\x9fV\x113x\xad\x93\xb8\x87fm\x16\xba\'4\xb9\xaa\x1e\x96p?i\xb4\x98Siym#\x80po\xe9\x87\xde\xb0\x1d\xe3\x01\xe9\xd4\x19\x9b)\xe5urWi\xc6\xb4\x91\xa7\xd2t\xb99\xae\x0fBy\xe5/8N\xb9\xf2\xa2\xfd\x15\xfb\xb4\xa6W\x94%v\x96\xac\x10!\xbfI\x1e\xa4\xe2%\xbf\xd4\xc7\x16__\xcf\xc6~<$@\xa4 \x02X\xf6\r\xe7W\x00\x0f\xba6\xe1o\xf1f\xddN\x06\x00\xbcs\xf9\x13N\xb9r\xe8\xfdxR;\b\xfd\x1db\xba\x84\x9e\xe2\xaa\x90\xbe\x8f.\x9d*O\xb6\xa0b\xe7\x10\x1c\x00'/984, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = dup(r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) pwrite64(r9, &(0x7f0000000040)="a1", 0x1, 0x8427) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xb, 0x12, r9, 0x0) io_submit(r6, 0x201, &(0x7f0000000540)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) clone(0x0, 0x0, 0x0, 0x0, 0x0) r12 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r12, 0x0, 0x0}, 0x20) mmap(&(0x7f0000531000/0x2000)=nil, 0x2000, 0x4, 0x40010, r12, 0x84851000) [ 375.825731][T12260] chnl_net:caif_netlink_parms(): no params data found 20:31:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket(0x0, 0x0, 0x0) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsu\x00', 0x400, 0x0) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000080)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001480)={{{@in=@broadcast, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f0000000300)=0xe4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x20, 0x10, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r3, 0x1}}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) bpf$MAP_CREATE(0x0, &(0x7f0000000180), 0x40) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uhid\x00', 0x802, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f00000000c0)) ioctl$KVM_RUN(r4, 0xae80, 0x0) 20:31:20 executing program 2: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$SIOCNRDECOBS(r0, 0x89e2) ioctl$TIOCSSERIAL(0xffffffffffffffff, 0x541e, &(0x7f0000000100)={0x1, 0x0, 0x0, 0x7f, 0x0, 0x20000dd, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB], 0x1}}, 0x0) setxattr$security_selinux(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='security.selinux\x00', &(0x7f0000000180)='system_u:object_r:dhcpc_exec_t:s0\x00', 0x22, 0x2) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000280)=[{&(0x7f00000000c0)="800000003804000019000300e60100006c000000000000040000000001000000004000000040010080002e360e59acaa4f37be5a0000ffff53ef", 0x261, 0x400}], 0x1, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) [ 376.279752][T12281] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 376.328869][T12260] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.336337][T12260] bridge0: port 1(bridge_slave_0) entered disabled state [ 376.345906][T12260] device bridge_slave_0 entered promiscuous mode [ 376.408809][T12260] bridge0: port 2(bridge_slave_1) entered blocking state [ 376.416650][T12260] bridge0: port 2(bridge_slave_1) entered disabled state [ 376.426327][T12260] device bridge_slave_1 entered promiscuous mode [ 376.470454][T12288] EXT4-fs (loop2): Unrecognized mount option "/selinux/mls" or missing value [ 376.479912][T12288] EXT4-fs (loop2): failed to parse options in superblock: /selinux/mls [ 376.488493][T12288] EXT4-fs (loop2): Number of reserved GDT blocks insanely large: 24436 [ 376.583143][T12260] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 376.670413][T12260] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 376.904782][T12260] team0: Port device team_slave_0 added [ 376.936216][T12260] team0: Port device team_slave_1 added [ 377.078354][T12260] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 377.085533][T12260] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 377.111915][T12260] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 377.158924][T12260] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 377.166106][T12260] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 377.192331][T12260] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 377.329281][T12260] device hsr_slave_0 entered promiscuous mode [ 377.423093][T12260] device hsr_slave_1 entered promiscuous mode [ 377.562038][T12260] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 377.569675][T12260] Cannot create hsr debugfs directory [ 377.864166][T12260] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 378.051663][T12260] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 378.115537][T12260] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 378.245479][T12260] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 378.579470][T12260] 8021q: adding VLAN 0 to HW filter on device bond0 [ 378.631964][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 378.640911][ T2770] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 378.678104][T12260] 8021q: adding VLAN 0 to HW filter on device team0 [ 378.700547][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 378.710711][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 378.720047][T11480] bridge0: port 1(bridge_slave_0) entered blocking state [ 378.727283][T11480] bridge0: port 1(bridge_slave_0) entered forwarding state [ 378.809648][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 378.818992][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 378.828926][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 378.838765][T11480] bridge0: port 2(bridge_slave_1) entered blocking state [ 378.845999][T11480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 378.854988][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 378.865940][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 378.876948][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 378.887424][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 378.905631][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 378.926959][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 378.936455][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 378.974997][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 378.984806][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 379.003424][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 379.012898][T11480] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 379.038129][T12260] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 379.107489][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 379.115742][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 379.157826][T12260] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 379.386372][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 379.396759][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 379.494886][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 379.504661][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 379.534044][T12260] device veth0_vlan entered promiscuous mode [ 379.544748][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 379.554031][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 379.604297][T12260] device veth1_vlan entered promiscuous mode [ 379.723927][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 379.733493][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 379.743081][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 379.754323][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 379.789531][T12260] device veth0_macvtap entered promiscuous mode [ 379.817324][T12260] device veth1_macvtap entered promiscuous mode [ 379.913714][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 379.923424][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 379.941618][T12260] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 379.956623][T12260] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.966650][T12260] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 379.977193][T12260] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 379.987152][T12260] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 379.997698][T12260] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.007680][T12260] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 [ 380.018226][T12260] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.032117][T12260] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 380.057141][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 380.067787][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 380.120236][T12260] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 380.130912][T12260] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.141868][T12260] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 380.152415][T12260] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.162431][T12260] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 380.172964][T12260] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.182928][T12260] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1 [ 380.193570][T12260] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.207752][T12260] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 380.218492][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 380.230690][T11601] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 381.123346][T12331] hfsplus: unable to parse mount options [ 381.284405][T12334] hfsplus: unable to parse mount options 20:31:25 executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x800452d2, 0x0) 20:31:25 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = getuid() setreuid(0xee00, r1) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) read$FUSE(r0, &(0x7f0000000400), 0x1000) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:25 executing program 1: set_mempolicy(0x4003, &(0x7f0000000140)=0x101, 0x2) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x5, 0x490081) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x80000, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) setsockopt$inet6_opts(r3, 0x29, 0x37, &(0x7f00000000c0)=@fragment={0x2b, 0x0, 0x7, 0x1, 0x0, 0x3, 0x68}, 0x8) write$P9_RWALK(r0, &(0x7f00000003c0)=ANY=[@ANYRES64=r1], 0x8) 20:31:25 executing program 2: r0 = gettid() r1 = perf_event_open(&(0x7f0000000640)={0x3, 0x70, 0xee, 0x0, 0x4, 0x0, 0x0, 0x0, 0x91dd7106ca8b533b, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x40000000000, 0x0, 0x7ff, 0x0, @perf_config_ext={0x7, 0x3}, 0x0, 0x10000000000004, 0x6, 0x0, 0x0, 0x20000007, 0x2}, r0, 0x10000000c, 0xffffffffffffffff, 0xa) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='cpuacct.stat\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x400012) perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) r2 = gettid() r3 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0xf, &(0x7f0000000a40)=ANY=[@ANYBLOB="fac6f447b522b7bd70a2fa3b25008c34c551e155ecbe25bcf4019bc3d94cbb8047d3b2f12a0c9ebdb7c14ef54e63d8bc9abf3815e913bdcf9392a0fd336019e9f27c57751f439779dc9553243037483a0328352a5bc216fb1783e4715bf5212c7f50d80000000000000000000008000000000800"/125], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x78) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000600)={r2, r3, 0x0, 0x16, &(0x7f00000005c0)='cpuset.effective_mems\x00'}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r5, &(0x7f0000000200), 0x400c00) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='memory.events\x00', 0x26e1, 0x0) ioctl$TUNGETIFF(r6, 0x800454d2, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='memory.events\x00', 0x26e1, 0x0) ioctl$TUNGETIFF(r7, 0x800454d2, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r8, &(0x7f0000000200), 0x400c00) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='memory.events\x00', 0x26e1, 0x0) ioctl$TUNGETIFF(r9, 0x800454d2, 0x0) r10 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000b00)='cgroup.controllers\x00', 0x2761, 0x0) perf_event_open(&(0x7f0000000240)={0x0, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0xffffffff, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0x0, @perf_config_ext={0x7, 0x6}, 0x28ca0, 0x0, 0x3, 0x7, 0x200}, 0x0, 0x0, r10, 0x8) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000001940)=r10, 0x4) r11 = openat$cgroup_ro(r10, &(0x7f0000000480)='memory.events\x00', 0x26e1, 0x0) ioctl$TUNGETIFF(r11, 0x800454d2, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r12, &(0x7f0000000200), 0x400c00) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, 0x0) r13 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1024}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r14 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000380)='syz0\x00', 0x200002, 0x0) openat$cgroup(r14, &(0x7f00000004c0)='syz0\x00', 0x200002, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0xfffffffffffffffc) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup/syz0\x00', 0x200002, 0x0) gettid() r15 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r15, &(0x7f0000000280)={&(0x7f0000000040)=@ipx={0x4, 0x1, 0x101, "2b04ec665b4b", 0xff}, 0x80, 0x0}, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r16 = socket$kcm(0x11, 0x7, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={r14, 0x15, 0x1, 0x4, 0x0, 0xfffffffffffffeb2}, 0x35e4ed281d171825) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0xfffffe29) socket$kcm(0xa, 0x6, 0x0) close(0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000006c0)) sendmsg(r15, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) socketpair(0x1, 0x2000000003, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x0}, 0x28) ioctl$PERF_EVENT_IOC_SET_FILTER(r17, 0x89f1, &(0x7f0000000000)='ip6gre0\x00') r19 = gettid() perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x8, 0x6, 0x5, 0x40, 0x0, 0x200003, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={&(0x7f00000003c0), 0x1}, 0x4, 0x0, 0x0, 0x8, 0x0, 0x4, 0x80}, r19, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x1}, r19, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r20 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r20, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000100)="2e0000001e000500ed0080648c6394f27e31d20004000b404b48000001000080000000000300f88000f01700d0bd", 0x2e}], 0x1}, 0x0) r21 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r22 = socket$kcm(0x2, 0x3, 0x2) setsockopt$sock_attach_bpf(r22, 0x1, 0x3e, &(0x7f00000002c0)=r21, 0x4) r23 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0xe, &(0x7f0000000840)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000700000000000000000af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ec56175037958e24e5e000000000000008b5e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07f34e4d5b318e2ec0efd49897a745f801ff110026e6d2efe31ab7ea0c34f17e3ad6ef3bb62205b341a2d7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7eaa49c62ba0fe52fa65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b63e1a9cf6c2a660a17e3c184b751c51160fbcbbf35b1e7be6148ba53246dfebd31a08b32808b802000000000000ea334d8323893c5337669dd27080e71113610e10d858e8327ef01fb6c86adac12233f9a4ecdc7cec61ce63000000800117009a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697a6ea0182babfeffae2ed4a9590c35c4a84296693ab4390af9a9ceafd07e0000000000000000100000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x62}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r23, 0x18000000000002a0, 0x2b, 0xfffffffffffffe7f, &(0x7f0000000500)="b9ff0300600d698cb89e14f088a81fffffff00004000630677fbac14140ee934a0a662079f4b4d2f87e5feca6aab845013f2325f1a39010108038da1924425181aa5", 0x0, 0x100, 0x60000000, 0x0, 0xfffffffffffffe09}, 0x28) r24 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000001a80)=ANY=[@ANYBLOB="9feb01001800000000000000c0000000c000000004000000000000000900000d000000000f0000000200000010000000030000000a0000000400000009000000020000000d000000040000000e000000010000000c00000000000000040000000400000003000000050000000900000000000008010000000f000000000000010000000057007500010000000000000900000000060000000000000200000000000e0300000000000000010000000200000604000000100000000002000007000000f7ffffff0b000000000000020200000000610000"], &(0x7f0000000780)=""/111, 0xdc, 0x6f}, 0x20) r25 = socket$kcm(0xa, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r25, 0x890b, &(0x7f0000000000)) r26 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xb, 0x204, &(0x7f0000004240)=ANY=[@ANYBLOB="079ffbf4a20300000000000000ce1e5ec2236f10c88a839b74071297e52888a32f4cca85cbc3588591c72780bd1ec0beb70c9ccb8721116f0e8575058856e003f540c2e61294c63624b4f5079dbd72867c886321e20473607e9bcb8f860396c7a2eba8dd7f943da9d6fc3a4397c5dd9fccf7fb646f903c3add864d3acf37bfbe98857d95a85de9868fc6eaac1f1d716480c36a9cf4ac05db1f5fb52769e49a05ebe72ffd488650ae0a8b8520de94db2f71392110f819101bda44f601561201e31d21b56acf2cc4c988165d3638256d0897776258f1f81cd8cfa9f87860f7879ff7c7895ad4e333bb1bf495cf7cbc9ba7464858d4cc2e45a26f472789d1fc4c524094f7ba55ecf66c94268d189a74f47c2da8b18e3b9df92bc95d41ab902b5c289029944e2c1e783e4bbe935d43e84aba59cbb083e842365fffbd053156e33084bf50370cf6d82b89d2511ed8184ff4cfdc8f5a632dd670853c506ce2a42d067e509db1c25d7af8aa0c910d858de7310cc72bb22294a701c0796d7356321eb0ef30d842ba8fc7cf79622d57438696e7a71979d16e00589bf17b0cd5d1e5ab65bbe9119586c34479c08ff432ba33ff5bdaaf6cb8ad753ecfad35fa4540f1eca0deb40d26273396df67d5e3591bb41ed29e3ca99476b2f4fc4dfd4237238c8aef31bf58feafb98d76919f666bfca08a36cbbddeecbfd6ee2d8ba6d73111141e0f3c8b637f2454c6012abf48eab3b3bfe6ccbde357262e3638a5079123cfb52cdcb0362faae7ae807af5589181f503a4d51dcdf8e64671be9627efa436b06e13f70426b2bcef9716a3d78ac66da882fc06e59d43f1a551243e29fb6fd784fc3d64280900b07e5c0f2c3673335a28a2c28bc8a1c0ae7953e0156db11e28f3ae158a605992b07ee5ec2c9387a0ed3074f2dd67fccce07e1a002b14664e4843e5a7056ea3f03d561b5c1dcbce6fd80bbeca226e0370f7b4e91ec63985dd240dc7da41637a9c0f3ac73c05b1aca7fc453a1c6e7a2cf6a9b08229dabc3b5b61f66a569dff5a60efc41108592d03934095cf6561cecfacd417398fcb511f0e25199d287c7c8696684527dae4d548640d9e6ac95dfcdff842092d2e2b17d059817a66c8e548e0fd5483df83b055d4408e5e54a3413c7ff37cc1ae49b47fe0282348a5081aed1f1adcc9e7d89138c18db5c22e593e6d37fd0b7d9c5999746dd945c09463f5f71ebd28fe6ef3739eb3ce0f40c519bb57a42166c09a368ff161f79a0d620dea1cf1360eda98cb1e612b457c6cdcf8d0e42c091699c01b4c2b508dd24414a5769cb833d9d7564689fd6684266093da77e1fefd536b2c8be25a1b3a517c39c548730cb539552fe2c8d3ca9262b2f4f8e7088e2dbea4e1c9fd7e1e20fe2e63ea0c9f8f23ef986b8809b3fef6ea29c6e3b8cb579ee685abb821d2ff71949831c1e06da3a1927f7df478dce7a6d26a925eb770af41c968a1018a518ef6da4b6d18ff584120ea2ea90ce3393ef88d175ace9dc8a2fcb173557ebf59e94af3825ba2a08474a28006b0df080d7e90e1b0be37a780581cbb67ffb2966f248163a4f0b9ff159f48112a8cd9e5fdf3912e0bc1bf223ee2d270e7e43bb056d1eaff40796a214c7b73d7929c4a6dbf9c49a51b8858657c9ee73ab3b0b599174771b63a0303e7751bdc772990c542fee83f25e9e7ec303d0a60b6d6dd3be3cdef0bd54b9ebcd5e7b983f991cf558f98499871013fc48dea33bb2f8c36454f7af2f38610c87f59409b3eaba4910e5c841e0b5172214052096c70a10a98979d6f014639d0d0cb525bbb95f502e2c883f041d77d52635330e4de9a557c9e432dfeb90cb39944d3c1320dbf7b91a4a6b237f88a3b1468dc922b4eebd06c5783c81f949feff76ef8cef82891c0c37baeabc3ed29dfc3e8bc706f3148b9b9967b31281b9da97fd83bb42e16c162e241e48800d4311fce6e4eb6df0ee1523f59b8f0b557740c95d4a707033c3655506b949084975f4954e3bba7a040f73485db51ca4de7bf914b23a24584967ab0218b41ee5ba5fd34e49441711f72265914822939afd82d00b94cdde44efa325f25ca50b5a79ef94b9a65591379081f4394c85f47f18fe3a5d40f2ae17f214296c75854a67abf6e5f620999648549b1d76cc0dd3aad12f14f651898dd0a3c4647f850229403f328a7ccaa48ac51590f00228dc4239e2a9354b618acc73c9917ef845e6717f8911cbea8912cdc4f5fcc635c46a224d157f7b99fff757b224f3e843cf56136c7157fc8b5db27c325970f176b7b9d81ab3481c21085c92a1410c4c736ad0f5819ceed0d3cdd90ac636fe02903e4cc3616d6ae7d8de66da6f8fff910fb4c3df12fade48c6763726fa900eea9abce2bee79ce8ae2a4f7833f1b43c0fee565e45e48ddc9705082cb239ea152e1b0d422b013dc08a2259e945710688350e6ee68262c410739c2786f1cc6206b1a43607aa787919e39c50586a68eeddfb1dfde361ee33b34fe2d2d74a67f665bf5467cf16ceeeb76a96366f10e7f62c1db673102dc23ec37da375248d5e76bf31c253334f0840fc8744589802f65d453a1cf771d5c6c369b95937ba597faf8c8a325c9ade109eb172d8727eb6c778d0a70f46bb82643dca96adae0527ee892f0491dd392d0380e4f4f99802d827fba8c11f934ff8dc382b1d42664b5ad08af6640657adb0d1125818752109ec2b922ea72cea997032fa012c3e6697999f5e3d066687f155c85ce9cdbfa5f316a973bc0b1255a7aeedba3ae4eca60670c7aeb8748498c36f9395f0323945c018545fcd71073547366f1bac3a99edf1d7da14e9c0e69807358fd76bc86d8f1ff3ed2e6dbf21c80ad27e68622658d30a88406a3cc7f21d073f93df9177d81876a4c11eb205a3ea4d71081a6bcd65e916ab2b550edf026153697d01aca18e676e9dc8e7d5b63d99f9cf9388417e7692ebe0feb50dc70a4bd5c25b83c8e8ffb7a7027a1784b7a36208c70b629657631d2a66538342b0f8273bd5dbb2ed9e89a406896c360b51bf9e22c7fdc8fbbae9fbe579d18b856d667ecd22bf2471f9eeb9ecd91d39e2de42a197eecee21858647cd70cd685b2659b1c35be59be833680d5cc9b6dc71049751b721235701a7522b2dc3dc25235c66bed3938b7c04352b3328a3b9b0db68f9c326d9389a691a89061aefca72d733c289be7e194c735f01b60fe68f0ecb622db5ff80d82a7347a6218ab1c66bcec8c87feaa0c0c86aa78508ca728ff062cf141d01ecf3119a8fdbc752a3377d291a8e45f9d2fce77805f7a2c4c6b897f4bc8aaf699631fdb73c340e79611d706e2cb7206860462be71836f7c69f4da24a1f4f0a9d1864dc8c1432d40cede75e131722aee0272f0bd37704cca833aec9526f0e6361cb49a5c8ae4bfe1cce30eca68cd5fba5791192532f308a26bd1ac4d454ec6ae3926a26ea0fc3c4b54bae9bbfb65b6b5204eb647c2cf67ab3869710450490349216d9cd2ed87d85e0ee99efebc18631d2e4a4a3128db84c5f2c519fa8d4318d228941932b6a7691ae03b1cad55def4cd3c49cf2bd548c57afb2f3fa08eaf7a9f337170e3043c66936244315dd673d281531ea706633f8cc7c05a0a10f7c1793e05193312c67221969617f09dce9185da938e62d709dc5fe5caea5bdc225f19eb94d4562d933c8a141a4e3363842589818e9098afa2ef8bbe66a615b57491fd3a016882cb1097dc4286e235445179f71da1012a1d5a391b35b77a67939f84a34726053b738b0b18f4e625e13e6631a3f60357898621abf93c6317406aabe6901efae9b41734a17c4069ab9e4cc0614b0c490283fb72263789fbf3f22a3e7583fd8a3c06f3a4fc521734f130a30918cde75a18ee1a3284c59ebd045711312a8507395fb08c117c549855d50a1dc4d13fe648032cd3c570ab7ca09f67f3c1e604e7b88b3c956145e3fd750f8b98708cbc0b3be78439b5ac87c1a4f206d9bbb05d8d3ff4298502233ed01b51a75b9f4493888ec17b85f2690582ac3fe763bea276bce9767589b4abd22115a71d5ad3e37e2d34f47faa3dfee27217df085afaf1cd39ab9c2dbe9d788d1b2ae9866f75719f0147dd1a14f836cadd62f2420c8097460dff2d436114736b75f85245935a15ece22ac31b16be35693f56313d8796b324f9fb1b5a832122916abda1fa4eec9cba9951a56f4a13f93927718eb2122580fe16c5a624e63dd390787172664bb62a98c1b4336954dacad2684876735b910b9bbe9481992ae4c5cfb233ede3268ce99c75c464b94d0367951e64053d475def1f53b434606dee5f5352be9259d81c72591b7b063586214257c9e5de2e91fb0ca746698778e0b5f0dda96065425d90cb6252fea6ebe4fe05f8d6054b0a12ed1dfa602d8bf1d3111ccdcec766ea68bd9eedb9a7acf04bf52e1f7d3982fede7b761228003d3d490a3d4515291e2213567e82fa2e734e1cafc884520fccbe69016d58e0d8803617ab0c96dcc880d4ee5ac3bb3a95b08920c5af7507aa9b6c13c6e3cb7deda44fbfc4ef7afc892fc50b888057733b978b178e47e4973b70c4ce41d773d07b3d5338f484eaf88aaf5edce610bf4c26e970e1e64df128b4c5d5bcd2ec5d59672bb2ef1e7c848a824e61fcebbd9950cc8f16c9bd767f50c5f425e3d7ea0884c0d400bb5cf09787be590b49f2dd8d438c33b6fa923c7fe1147e12b914f2273125f68ecd7df3837ce31d35deea136e5b1b78158b3108e960ba9cc2fd2d168c3497e4474a10a9ad6e37a97292c8e52bcba8a3d6f0e68b6270f761debee52d44d63aceff1b2c358e6a03e69ed41b6914cd33f2e19cfac3142a203a3347bbb3324624daa780dfd800105d0cad84511f0783310f0fe24b2d04d5be826db1429a0fa64f5410e9dbb1033121b7beec1ad94428dedd69df0b479413e37b4930653317353ce56d1456abbe44a14cf56f8c852053098d1d15cd4415d80e28cb21c36802512ee2a1569234d8ae35475274943ace27f2764673364956862a252ab9f3b194a33a63544c85b67a22244097a1e220a1d7ee26d6a54f6a25a62aa71490c0d5ca99fc05030e31a3096d2f786a53719cff852f50b841c9f7bab236c2ce5e4f5b55ac4235b479f6ca1c97146bfdaf206cc0a6f26a5dda13b7480b7e81079bcd8b0c312512bd483e01cf51f72c0193c34f3bc48d03cf4fe2d21568a2a5164525563bcc53ac51876a367657cbb928e0e99268b701b6355795d0d85f24431751321bd0ce3807fbc44e9e9f66fac5ba4c721ac6a4837cf42dfa3537d8aa2c795349c7fc1953d3816de40688011e9e0296dda9cc8e81d2efd98ee529d2cfad2bad922585a594203ce9e645a298565d14da2d37172b659e4daa5f0d0ff05e851bcde4341775f28b157521b3e9b8bd2d2381d68fe410cdf87a08e7c312b6eee3af61f741e292a31a2b15af9f301fb2a0baab5139f7a294efab10a12f195749c2717caa1f7d7ce6d93ebb5d409cb1583169db9671091d93da1d83ccb3a3565098810aef2eae1462a4fc1608c5e4d8c4ff0eb266498bf50c518e770d2611d5f840c6b434e54661af835c261209525b2525dfc2076d0f7fb1af60a529d37daa82fdeeeb58eb0b987c3c7a6142170464660ca0ad83ecac1f38935c7e6fbca96c8b53d714306fe21de3653e2117745f80f15b1538be3cda15557fb0c807ca610fb4f1d2d00a284b267694bd27513be9c880dfa09c0ba737de89a12b0beda1cb38e8c1039fa6d38cd04ef0ca2b59f2ef00bf215cd100aedb16e51738033550000000000000000000000000000000000000000000000000000000000000049a6ee75e6abb1cf80fec8fa773314d28997ca27a129d56ebdf78df32d4b06e6e831ed18c098b293c3636307a2f6de5be9785b3a05f586f28aa6fa3a2fc922dc1232a5ce5570a30ca2de23d537e1c1f4593a1741042af368752d10fa3cd6eda4623e0169f85c70b53a848b4a3ab792f394482e3ad5cc2f31a2d9222d9f312909b668796ee7bd1808b48c769e11f085a687dd421b86b8f8f27a00efac985be8cf7604260d2b9fce6275eb45057f21e9c92e9da95d4c91122816232619e9d5ad88436b951a0d154b04755739d322f141ba399febedf6f5227b4e55a1f22da349586ec182b72ddc0c3f99396736f90d0e72a87c5589571beb7ffd9705798091f2930ef8608711051a402784dc3541b58dcbca9698ab5965c617d3145ff287f775153ec8710a7f59551716fc81867bf0e2b385cdebe58e09ced899a10e0549054bb0467deee032f99fcac51aa30e5356cdcf219be3e56994c6107609a6b76a0484fc423b82b7d520f1ebdc4c5aff4ff58e0deef7692ae233afc4c037c34fc55da62fcf46fd84e638ae4a6aee5d1100f1a1ccfae6e640e104ffe29e235112ef3976a67e9cab2a554b594442b30f89bc0342de274b75906b4e8e5ca4d618e92ea50c0a13bc45744f6fd58fd59642fa00cd90c138ff6605d8f6dc4a5724133c932656f7b746a601050684737907568f8280af4130aeb749e2a8c129ce1f3ffe73bc0cf09c51d55c813c44135aa0e089af1a0eefe106a7de3a89f2f6e083d9038be2d74867d719ff8e8a2bdae8b7e2dd06d15ea44f85137fdc5e37e10612eff955890898cb61d92d4f0009efe98f76263eb8f9f34412b234f8897723966100d5a062fc00d2d9513f964418d9b0696466ce2a7179e85c7946de579632dbb32a457b5c7558609c74ed94ae94deac1a4dad16728018be7bfb3f", @ANYPTR=&(0x7f0000001bc0)=ANY=[@ANYPTR64=&(0x7f0000001b80)=ANY=[@ANYPTR64, @ANYRES32], @ANYRESHEX, @ANYRESHEX, @ANYBLOB="3470efa550bfc38690cf0c02383293da48c88b1bcb0f61923666e9995853b6548ff7a590a106b397e533ca50d3b22ad4b9461bb21051496e01cd4967d20e1dc94392bb1236ed36981c0681d9943d072f1f26bf8b7d4c00f838c09636d182d1ce6215509ef45f74c43620a4c49f66d45e412c2b342decdce0ec1e50381ad0800d4664271a82833e578011a966d090774f37c927092c9bf1f560d3d673b8db49ec40fb1b9c144c0eff3cc433be9fcc637b4ed91be8ef7f027332a61a2b1a1bee552d94c76aab0af979238fd4fbb2b2bc332643189f3cbc3f38cae11a728c4f27060c7f5f1efd71fafb3e39db8f44b258f74a2fd4", @ANYRESOCT=r25, @ANYRESDEC], @ANYRESOCT=r13, @ANYRES32=r16], &(0x7f00000002c0)='syzkaller\x00', 0xa8f, 0x0, 0x0, 0x41100, 0x8, [], 0x0, 0x13, r24, 0x8, &(0x7f0000000340)={0x1, 0x4}, 0x8, 0x10, &(0x7f0000000580)={0x1, 0xc, 0x80, 0x4}, 0x10}, 0x78) ioctl$sock_kcm_SIOCKCMATTACH(r18, 0x89e0, &(0x7f0000000500)={r16, r26}) socketpair(0x0, 0x0, 0x0, 0x0) 20:31:25 executing program 3: r0 = socket$inet(0x10, 0xc, 0x1) sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000003c0)="24000000180007351dfffd946f6105000a0f050a1f11000b002808000800014020000000", 0x24}], 0x1}, 0x0) [ 381.595208][ T33] audit: type=1400 audit(1583267485.659:64): avc: denied { write } for pid=12339 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=perf_event permissive=1 20:31:25 executing program 3: openat$vimc2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video2\x00', 0x2, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r0, 0xc0406618, &(0x7f00000000c0)={{0x1, 0x0, @identifier="30c763e233b3006b11848e5079b5ac2a"}}) perf_event_open$cgroup(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb3fc, 0x2980, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x2, @perf_config_ext={0x1, 0x17f}, 0x200}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x8) 20:31:25 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643db0ea87a350a31a7f6c8e628003a2ad45b16bb03be6b2077e70fd816beda9968a73535764e01b824ca5f0641de0c06ef4f8408bc633c6f31d7d923a6f8b359f53bb2958d8026a57b0795956cab0f2b84604b0491aec335891a08f97f5ad365394c0316bb755330171b817d5a4bb0037eabf4c170df67ff7a8d8d59bce28cc0bd49aab12da160ee89ecbf25e25ed6e0d871950f7fc9c55f55c7eb7604a5f50261a8c10309dd0b0e41bf3a35abfe5b7b06e56425b49beda13e0196ce1aa715a7f04e372ba04000000681131999bd68a29123ae97989b981e0256952fbf459b16e9a448632617e116220caf99c88347c7b9c085ed5a345d1a08a7c30928bac13bd4d16caf4c6ee09cf7b4941fadd12db40216e2458c32eb5185ba299500c781a206a0c3029b82b847ef47d62fc194de46bf49afbc9372e3d6ff7956f298594df48d65e2cc8b60006aef593562bb9daface2fec2ddecbca8fb6127597e58aaa46359f9f7b2837616d4e028f86dbef5cdd5060685e3c615b2df1586e2dce5e2590003f70b8ba70abf505644783d26af4a164ea5330fff2e6e2b64f29698b03589456e700efcbd70c59ebc629f495a1dc6215a9fafc859d52722f983a7326ba6a6fc2ee002f13c714289e6908b1146b8786074a4b5c4ee4ede3fffed08fbee6ceeba17962332da6bdb947abc77f934ec5f386b8b60bf422cc311682e51ab493a31ad0fb6eeff0c72fb69c08cd2a20990de28794e6938eb51b9fee571c9a4788941ca14ea0461915b93fdb6be98db888067ecdfba6e0add783afb18c9642ebde8cce4e33b07ee86a690665c3a12c96d4f3199bc26ac58172808f475e3858f2361518442a3c15f7984b2d7431e8da3e9b3d4935069c8ab9d12e1d11d380e0c1fb3020d75234a2e6f4241e614a4bf060008c740f0bc44b6c15dc0b7703a22ffca28282fb2b93ef8a031e54848b09771140f92b654db9b106d0aa32e744e96a7f2517321bff90053debba0c03ae722703b477f14fe0f5b858e36835e4df6cd6192b13dc2a6a59d9ac937dccd84658dc65504433e0e6291375f0acd33a8858dd2f4e6807facdff", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setresuid(0x0, 0x0, 0xee00) write$FUSE_INIT(r0, &(0x7f0000000180)={0x50, 0xffffffffffffffda, 0x1, {0x7, 0x1f, 0x7ff, 0x40, 0x1, 0x0, 0x80000001, 0x101}}, 0x50) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:25 executing program 1: set_mempolicy(0x4003, &(0x7f0000000140)=0x101, 0x2) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x5, 0x490081) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x80000, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) setsockopt$inet6_opts(r3, 0x29, 0x37, &(0x7f00000000c0)=@fragment={0x2b, 0x0, 0x7, 0x1, 0x0, 0x3, 0x68}, 0x8) write$P9_RWALK(r0, &(0x7f00000003c0)=ANY=[@ANYRES64=r1], 0x8) 20:31:26 executing program 4: syz_mount_image$xfs(&(0x7f0000000000)='xfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)={[{@nolargeio='nolargeio'}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) accept4$unix(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x6e, 0x80800) [ 382.160299][T12365] fuse: Bad value for 'group_id' [ 382.177939][T12343] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.2'. [ 382.226219][T12366] fuse: Bad value for 'group_id' [ 382.290835][T12343] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 20:31:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000000), &(0x7f0000000880), &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000280), &(0x7f0000000800)=0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r8, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="2800000011000d0400"/20, @ANYRES32=r4, @ANYBLOB="00000000541a2008000008002e0000000000"], 0x28}}, 0x0) 20:31:26 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) pread64(r1, &(0x7f0000000240)=""/176, 0xb0, 0x3) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 382.441362][T12369] XFS (loop4): Invalid superblock magic number [ 382.445426][T12380] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 382.479565][T12380] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 20:31:26 executing program 1: r0 = creat(&(0x7f00000008c0)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='overlay\x00', 0x20000, &(0x7f0000000140)=ANY=[@ANYRESOCT=r0]) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x3ff, @dev={0xfe, 0x80, [], 0x1b}, 0x3}, 0x1c) [ 382.607176][T12369] XFS (loop4): Invalid superblock magic number [ 382.612984][T12382] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 20:31:26 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000000), &(0x7f0000000880), &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000280), &(0x7f0000000800)=0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r8, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="2800000011000d0400"/20, @ANYRES32=r4, @ANYBLOB="00000000541a2008000008002e0000000000"], 0x28}}, 0x0) 20:31:26 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, 0x0, r2) r3 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setuid(r4) r5 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, 0x0, r6) gettid() r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) ioctl$KVM_SET_LAPIC(r7, 0x4400ae8f, &(0x7f00000007c0)={"9266b5b915fd9adf6ba6eec1e4ee68d0998798263faf46b362d4387d30575c760c1383ceb1a7772750c438654bfcc6a4a089c6d46df7992dd3065062ec789b3c3c872035514c920f700ffc22cbd65c5783e5f494e80650ddd2264b79475dac8150a597edb8ba960c10cabf7d2be1a9ef489bccaa70c21c3ec802e86f3856492c5282c89157dc826a1acf47c966022d824f7908b85b2c98db97983e5a066d88a48b6f872f58b7a123cab4213a6f1dde2920f0c14594e78f0754f3e4fa8a42973a7701737c68296c29710c123a78f40da9f9b22f2fc84e2ea8b751fb5db88043d63bd0d783b2ab1e847b1db934ae8976b69644d92f980ab798f428ac92d3024570249bd60ecd10495112f4e012278962ba97e27b7dba64ac41ada586dff7ffb4ce9c0ca2c48cc9d418e65033385dd47eb3775f9364f195ee50da1a0619b003d1c7b8f2b0a0ceafa2b4d280ed00a7538821f1e1d723b69a39c68b54205a04f9eab15307bb9e25ea2f2c0650f9cda504c36db2a81f9051454f79ca7eff00f4d5be8586804f92d650cb98bde5d9c58c3de89a512c6abc1473bd57d6ef4bdb4424de3496ae5fc18f9ad57c3817eade36aac0a66398bec934ddf59733765302936b3de2189b0b68a39eeeb104440de46026ab2a4ae950f74eb22f40893ac1ffc153203349b1a873674f0358b3c35c9ffa5d3af864c68ebb4ebf432bb73b5d14d31748fb0fbe11a6382dd109aa109c967765099bc0a7c64f8cba03007fff5af2643a44824899e8955bc857b57f9b681b5512d48ccdcef16d8c83318634bfbe70f68b2f59aca43124a5730076db818efa05a65b6d7ab89ef10d6560edd18eaa90b200f71a88a69aec20507aa56d791504486cc98438ec2dfb4d6b9d91013fcd2924017acf813676d037c96da03d02e34bfcba795f0f4c55bd8a6f7e9e9f0e48c53d287a25217261bc09a6822e66d31217b1a07c611a8a4348c8e078a7a28390323ce32b114cfb857784caea0662f2f37fe43c5a867ee4457c2abfddb6b3edb3463aaa52fdac137ba7d3d11c4a0fd0042801efd670ac526904a0ff2a9af0f11e630d8301c668ecf6e772f0e30ddfd875cd31b24169ebd003a68ec73426fd8f0b27d80e9f819c33232f79f8e3740c9239d2e771e33e3577c9b0e389710e077af8219c99e8105da552a318aa08aca3edf46cf96c42c59e86d3c92f5c0bf49e871361fd4a167f0850c66c0256b672e1b1a1d21915bb8ffd04235550cd91274af3590c04fc3b6691dbb0bac4228384e135782bfda3b5f12f159b6866261948ba441c944ece813151bfed246c2d24501f8c0ef019c6496b06f8951856426d0d82862d16109c52cf68d5296832f70d7ff89b5135360051deb96b8bd6bcd344b48561f3e754a3c2e006cd771ccdf6589b9b8cb23f842344a42917cf901b9128f3395aac484cdf246c"}) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r9, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r11 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r11, 0x0, 0x0}, 0x20) getsockopt$inet6_IPV6_IPSEC_POLICY(r11, 0x29, 0x22, &(0x7f0000000d00)={{{@in6=@mcast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4={[], [], @empty}}}, &(0x7f0000000e00)=0xe4) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000e40)=ANY=[@ANYBLOB="48000000110001002abd7000fcdbdf2507000000", @ANYRES32=r12, @ANYBLOB="00000200400107001400350062720001ff07000000000000000800200004000000"], 0x48}}, 0x0) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xce, 0x82801) sendmsg$nl_route(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@bridge_getneigh={0x0, 0x1e, 0x20, 0x70bd29, 0x25dfdbfd, {0x7, 0x0, 0x0, r10, 0x4244a, 0x46000}, [@IFLA_OPERSTATE={0x0, 0x10, 0x80}, @IFLA_EXT_MASK={0x0, 0x1d, 0xffff8000}, @IFLA_TXQLEN={0x0, 0xd, 0x1000}, @IFLA_ALT_IFNAME={0x0, 0x35, 'syzkaller0\x00'}, @IFLA_GROUP={0x0, 0x1b, 0x6}, @IFLA_LINK_NETNSID={0x0, 0x25, 0x1}, @IFLA_ALT_IFNAME={0x0, 0x35, 'veth1_macvtap\x00'}, @IFLA_CARRIER_CHANGES={0x0, 0x23, 0x5}, @IFLA_GSO_MAX_SEGS={0x0, 0x28, 0x7a64}]}, 0x1c}, 0x1, 0x0, 0x0, 0x817}, 0x0) [ 382.908323][T12350] netlink: 22 bytes leftover after parsing attributes in process `syz-executor.2'. [ 382.918779][T12350] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 20:31:27 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)=ANY=[]) setresuid(0x0, 0x0, 0xee00) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r2 = accept4$packet(r1, &(0x7f0000000240), &(0x7f0000000080)=0x14, 0x80800) getsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000180), &(0x7f00000001c0)=0x4) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 383.096839][T12405] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 383.218038][T12405] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 20:31:27 executing program 2: r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000100)=@req3={0x40, 0x2, 0x8000, 0x0, 0x3, 0x7fffffff, 0x8}, 0x1c) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x1000, 0xbf, 0xd45b, 0x80007, 0x3ff, 0x0, 0x5}, 0x1c) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000265000)=@req={0x3fc}, 0x10) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x2240, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) ioctl$RTC_PIE_ON(r4, 0x7005) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) setsockopt$RXRPC_SECURITY_KEYRING(r3, 0x110, 0x2, &(0x7f0000000000)='em1lo\x00', 0x6) r5 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000100)='user\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f0000000240)='{\x00', r5) add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000140)="1301a7118e521a227778ac79f4b8808100c745c728a4931a30e10a3bdc27af7cb7c460cc56ec7a7cebc1f0d728aad4ea", 0x30, r5) keyctl$update(0x2, r5, 0x0, 0x0) sendmmsg(r2, &(0x7f0000000a40), 0x8000000000000b0, 0x0) 20:31:27 executing program 1: clone(0x3a3dd4008400af01, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) memfd_create(&(0x7f0000000040)='\t\x00ste`\xad\x96\x9aum$\x00', 0x0) r0 = memfd_create(&(0x7f0000000140)='$.6/%cpuset]\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000940)=ANY=[@ANYBLOB="7f454c46020000000000000000c4b40003003e000039a594249c1fd83d00000000000000000000d1d2eb7bba00281293bd5d74dafc2038"], 0x37) rt_sigsuspend(&(0x7f0000000080)={[0x2, 0x4]}, 0x8) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) dup(0xffffffffffffffff) 20:31:27 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000000), &(0x7f0000000880), &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000280), &(0x7f0000000800)=0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r8, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="2800000011000d0400"/20, @ANYRES32=r4, @ANYBLOB="00000000541a2008000008002e0000000000"], 0x28}}, 0x0) 20:31:27 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) r1 = getpid() prlimit64(r1, 0x0, 0x0, &(0x7f0000000180)) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f0000000000)={0x9, 0x3, {r1}, {0xee01}, 0x9, 0xb82}) lchown(&(0x7f0000000080)='./file0/file0\x00', r2, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r3, 0x80045400, &(0x7f0000000140)) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f00000001c0)=0x2) 20:31:27 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/audio\x00', 0x41, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1\x00', 0x20b00, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f00000000c0)) sendfile(r1, r0, 0x0, 0x1c01) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$TCSETSW2(r2, 0x402c542c, &(0x7f0000000080)={0x3, 0x4, 0x9, 0xe806, 0x1, "dc6ca29e4a174e15fa4be20ec2b39a75fb73f5", 0x2}) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045009, &(0x7f0000000280)=0xfffffffe) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/renderD128\x00', 0x200182, 0x0) [ 383.836782][T12428] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 383.942854][T12428] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 20:31:28 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0xf) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)=0xe763) mount(0x0, &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x204001, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='mounts\x00') sendfile(r3, r3, &(0x7f0000000180)=0x74000000, 0x5) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) r5 = pidfd_getfd(r4, r0, 0x0) sendmsg$NFT_MSG_GETOBJ(r5, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x13, 0xa, 0x0, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4800}, 0x20004044) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x571502, 0x0) 20:31:28 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) ioctl$VIDIOC_LOG_STATUS(r2, 0x5646, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f0000000000), &(0x7f0000000080)=0x4) 20:31:28 executing program 1: r0 = syz_open_procfs(0x0, 0xffffffffffffffff) preadv(r0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/109, 0x6d}, {&(0x7f00000000c0)=""/53, 0x35}], 0x2, 0x3) fcntl$notify(r0, 0x402, 0x13) fcntl$setownex(r0, 0xf, &(0x7f0000000000)) r1 = socket(0x10, 0x2, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0) ioctl$NBD_CLEAR_QUE(r2, 0xab05) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r4, 0x0, 0x0}, 0x20) ioctl$SIOCGETNODEID(r4, 0x89e1, &(0x7f0000000200)={0x4}) ioctl$sock_SIOCADDDLCI(r3, 0x8980, &(0x7f0000000180)={'wg0\x00', 0x100}) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='cmdline\x00') sendfile(r1, r5, 0x0, 0x80000001) 20:31:28 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000000), &(0x7f0000000880), &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000280), &(0x7f0000000800)=0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r8, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="2800000011000d0400"/20, @ANYRES32=r4, @ANYBLOB="00000000541a2008000008002e0000000000"], 0x28}}, 0x0) 20:31:28 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.events\x00', 0xb00000000065808, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f00000000c0), 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000080)=0x3f, 0x1d5) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="006d656d6f727920ebc67fd8daf1e6cee6be9afa3dc251b088357c5c4e87c692ceb4e3fd4be97789b53fd537d41d4bfa5a74f37e86dd11a1b54e78eff33e9d4263cc4d17038f7cb3223bd782491fa396e1eba8d86c190dad019cdce712e2454e53c95525b7e1ef0ca30f5af27f8e3d3032e6aacf7d8a03052857bca0b8146221e15dfbe404a1d9f7520d348529fdfb6fa12eb6460af89f0632c88e16a78b3fe2ed5d078f34c1093d707fa408c5064fd1989ab4851f261d95bcc57544992761c9c7c104e76e4fb87e417ebd51fd04ef37d037d900ab688597e46133f4851215d4e1098ee1a95cbaaf7a864525e1ddcc1e2de44202df8f0e7e70ffba828a458a83a8f3be36f9a527a83c377d3754ee9e3290797a4e41a3e70679d035ed8a45b778a7646cff6ab18748dc3a2e78886b3feabde8f966c20f1d471904d580d1b2a63b8fd2f60cf77ced8c641af880930000000067c27cdcf7e063c8d2cf6a3fe968b9819fdbab682b832bc825c0b7e150364cf1434ea4ad3af429ea31bea8f007f8cb7dbb992577d1141a4af647b1ba999bb0a4460a458758cf1c41daec8fbfecd57e6f38ca5880cb628c76d9e40bf27670868ba6cc95f887a49323"], 0x3ff800) sendfile(r1, r0, 0x0, 0x10000aa00) [ 384.549130][ T33] audit: type=1400 audit(1583267488.609:65): avc: denied { watch watch_reads } for pid=12451 comm="syz-executor.1" path="/proc/12451" dev="proc" ino=34417 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=dir permissive=1 [ 384.599911][T12453] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=12148 sclass=netlink_route_socket pid=12453 comm=syz-executor.1 20:31:28 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'vlan0\x00'}, 0x18) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="03507589758bddf2c2bdc5ca8fd8fb93053bc5c4f2b44b62471b2c726f6f746d6f64653d30303030303030303030303030303030303034303030332c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 384.722319][T12458] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=12148 sclass=netlink_route_socket pid=12458 comm=syz-executor.1 [ 384.748178][ T33] audit: type=1804 audit(1583267488.809:66): pid=12459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir396612305/syzkaller.HWXy0X/33/memory.events" dev="sda1" ino=16648 res=1 [ 384.750121][T12455] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 384.776736][ T33] audit: type=1800 audit(1583267488.809:67): pid=12459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16648 res=0 [ 384.913878][ T33] audit: type=1804 audit(1583267488.879:68): pid=12459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir396612305/syzkaller.HWXy0X/33/memory.events" dev="sda1" ino=16648 res=1 20:31:29 executing program 1: set_mempolicy(0x4003, &(0x7f0000000140)=0x101, 0x2) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000640)="a4cb9df163ffba71140f21f17218fa11feb536d45f6f3a90013d33e2e52869b76856c3aadc95593e3ba302adbfb13e0b0a5138c348e1fc48ef39065774e88890f986c64506cbee5e7463bafe17e792aa092e1eff0f00000000000098dd7dd2b6ee63eebc8f32e3ed24ada587f51ac0d3aab28e7840db757ec729617f613b91cd3908000000dc70dbda126d9df2ee0c8c259ccf62b8c4dfb021ccf01b600d6d4d8e0383469291031fd36860d857f5a561e8afb28c502f1e577371a542c9957deed3292168a1c3b038d618eac076a87e3c3d01431da5bda2942ab52bac569f911d7588ea63564d81f7ca34634481fa41142bd4d229ee3bbc44ed00000000000000000049a635efc404470347142a121637617ce9af6e6fcd86ed34e1a0121407ebc2c4aef397f5754efafd1d0d156b4ba457d41a97db57c944dfa868823d5ad770263d1435d41d9507370a6f902e0cb2bd4730cbdcd277ab73d16d80717da6545630ed3f110ff3814347520a18fb07b182d560ee1a0787412ec3ba094e8d59dfb5e56c9e3763eff7d9d1e0d8133f11c29f49ecdd25ed0188826b595690ddddb742b61bab57ad46b23cc300aa0bee571d4ae2ea5acf68187824be0aa948a6724c48ba5a5e00e373c82dffc8549d82472407ac6cdc844385c9d178ffff4957b8ae2180b9f8a19dc31a81054f672d4d95", 0x1ee, 0xfffffffffffffffe) clone(0x4000000, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000140)="2400000043001f0014f9f407000904000a00071010000100feffffff0800000000000000", 0x24) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x1}, 0xe) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000200)) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000180)=0x10) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x200004) sendfile(r3, r4, 0x0, 0x80001d00c0d0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x60}, &(0x7f0000000100)=0x8) ioctl$TCXONC(r4, 0x540a, 0x3) socket$inet(0x2, 0x80001, 0x84) r5 = syz_open_procfs(0x0, &(0x7f0000000500)='net/softnet_stat\x00') write$UHID_CREATE(r5, &(0x7f0000000440)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000340)=""/203, 0xcb, 0x99, 0x8, 0x0, 0x7, 0x6}}, 0x11c) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r6, 0x84, 0x10, &(0x7f0000000240)=@sack_info={r2, 0xfffffffb}, &(0x7f0000000280)=0xc) r7 = socket$inet6(0xa, 0x400000000001, 0x5) close(r7) r8 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r8, 0xc040564b, &(0x7f0000000580)={0x15, 0x0, 0x5001, 0xe, 0x3, {0x1, 0x9}, 0x1}) [ 385.000371][T12464] fuse: Bad value for 'fd' [ 385.009202][ T33] audit: type=1800 audit(1583267489.069:69): pid=12459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="memory.events" dev="sda1" ino=16648 res=0 [ 385.045354][T12464] fuse: Bad value for 'fd' [ 385.109984][ T33] audit: type=1804 audit(1583267489.109:70): pid=12459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir396612305/syzkaller.HWXy0X/33/memory.events" dev="sda1" ino=16648 res=1 20:31:29 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000000)={0x2, [0x100, 0xca7f]}, 0x8) 20:31:29 executing program 2: mknod$loop(&(0x7f00000001c0)='./file0\x00', 0x0, 0xffffffffffffffff) clone(0x4007fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f00000004c0)=@md0='/dev/md0\x00', &(0x7f0000000d80)='./file0\x00', &(0x7f0000000380)='f2fs\x00', 0x20, 0x0) mount(&(0x7f0000000000)=@md0='/dev/md0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='securityfs\x00', 0x8, 0x0) 20:31:29 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x2, 0x80042) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x0, &(0x7f0000000640)=ANY=[@ANYRES16=r0], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x74) 20:31:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000000), &(0x7f0000000880), &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000280), &(0x7f0000000800)=0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r8, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, 0x0, 0x0) 20:31:29 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r0, 0x0, 0x0}, 0x20) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f00000000c0)=0x869e, 0x4) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000003c0)={0x0, 0x4}, &(0x7f0000000440)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000480)={r3, 0x7, 0xb0, "6e11c9dab596a74eb1d629498c499dada641334488dad58b8808ec62506d8901efb7e77e7bed54f039c956cd4585e7df01c888ad702ca4a8481ae0cde783b421bf90dd92225e0a7fae19d12c5315a2e8590352092f24edbcdd983553f0cbc960b511d87239b02a6c286daf381476accea31d6c9e7925114ceb13a58499edf679469f307314541ec61d905d0d4814cb2ae178c8a1258d7ae5f343c6388808215787ddf4b654382da14265f24fc7208312"}, 0xb8) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0)='nl80211\x00') r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x48}}, 0x0) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r4, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4080) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000180)={r0, 0x10, &(0x7f0000000140)={&(0x7f0000000100)=""/19, 0x13, 0xffffffffffffffff}}, 0x10) r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) bind$packet(0xffffffffffffffff, &(0x7f0000000540)={0x11, 0x4, r7, 0x1, 0x9, 0x6, @broadcast}, 0x14) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32=r9], &(0x7f00000001c0)='syzkaller\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], r10, 0xa, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0xffffffff, 0x400000}, 0x10, r8}, 0x74) open(&(0x7f0000000080)='./file0\x00', 0x1e8c0, 0x94) 20:31:29 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') syz_mount_image$bfs(&(0x7f0000000040)='bfs\x00', &(0x7f0000000080)='./file0\x00', 0x401, 0x4, &(0x7f0000000200)=[{&(0x7f0000000140)="755b3a42c344db29b12e87bf30384d8cdd5649166e7dfcac07f50e54df58239649c3dec0d494ef3cb398ff2375633b37f8e8b398938507592c", 0x39, 0x34ee}, {&(0x7f00000001c0)="581a993a47ece3164ed5e54697d3739c35e0cdcb2efe9ebc31daa1749a542415a5ae6d19368a104931ea9fe32d", 0x2d, 0x8}, {&(0x7f00000002c0)="13b0d3cc556885b8df065baad160f451ed353e8cb2886082d3b1fffae28c8f6dd4550c6d29fb913babb615186d0a6e6bd84ba706706d478d84b0b46ef0a40c52adb1d95d48ba48b2694640a7b4ffb8ff8d9ea24639e9be013711b6abd26968862291db611bbb07e34436d613d47deecd9769327989082f216b4dae5507e6818bc5727ae3c9a96e1179aa13db5d04866812db77e802c35c1b66e6c145e16808462cfc0e7bb196106f8c3936ab09ff756496848b50f0f13e8e63dec3f637170d1170afbf5eb03bb6f2728f74c54ff20813c97fbc4d4681ac601619b53bfa43e1794d54f893fec61a0fd82ef6b34f92d013d9a7ae", 0xf3, 0xfffffffc}, {&(0x7f00000003c0)="228053fb3b8e4bb2ea37fdd24f6189164ed51941ced6e13a803e15f4c5f32e0caddb8b876ca8760e24245c9dfbd554527960bd1322a79f03b7666f9a487550b86514af8d4333bae7ef09f065104124b4bce0ea337addc361fd0032f97ba56a1facdbf7e252ec91b3c3de168df2a83ba0e9d4146b588a545a3defa5bd0ff6dc4f16ef411f8d18afb84874d5eb3de31ee724507adbe10b12d93b74f1de149a15fa6b300b0517d168564344f423382af25097f8c4e80597899b54e5f003961ca5e4e240e0baba063c09c8cced3287a1fe419a410aa011e26c3eab6a26caa256e844a93a0cf5c9bee0e313622fbb22bc515b7980d56d93", 0xf5, 0x9}], 0x1200000, 0x0) syz_mount_image$nfs4(&(0x7f0000000240)='nfs4\x00', &(0x7f00000004c0)='./file0\x00', 0x4, 0x8, &(0x7f0000000a40)=[{&(0x7f0000000500)="22a9d4dc736e2ceacadbd7c315f82a575c65c875", 0x14}, {&(0x7f0000000540)="09a234cf48f088592e894120465b349107e4349c99665d1382c8c3cd440319d9a8d392ef30c1c7f177de462bb190b66686ead9820114f00dcf49cf882b1d654b3e9960a4a7368276648140ad97c2843881e169c50cf5bc205eacf8d9bfb628b5bb626fee988dd8c85ccd8892e56f21f5bca4475bdbbdae6ae90a92b574af8f2c02f55b49e09e2301604b0a9773ebb710edd347ccf2b9b9602ead522339b693d0fb0e9ed44f534881c29566835c4f0755d937444d69c4a1adc07507a535c8e5d6bf4a22097e963de1881c9a8fb64fc6bedbbadf309bcc4e64a6b0d65c9337ec7f9318ccfa2c98a5e1c481005e93eb1f630466a75aacda729cdc", 0xf9, 0x8}, {&(0x7f0000000640)="84242c11df9256a8a9ef1423511f8b2313197a63c5fc401b2a4163e9ce43c20663ada7e292bbe6b10fbd570f802e3b17abf7341c057f97e13245b4286532cecb5a4bde078faef07c943cf245964f42c1e83a6fb5f6209640898629e0b0", 0x5d, 0x1f}, {&(0x7f0000000b00)="096baea1e0b2c0aebf191acba48ba3556dc3fcd6abcbde31e77e7aa29c9061d914bb4cf3e37053ef384ab27a8898a64c3bf72369378da6b9f59d97e9ca73376db9d65ff2b1da5dce7cca241b08a9fa80bbc502db822a68bc39f1bdbc74a4c35ca4a1785c98c3f933eed15947d4f4acb2d84770fb790ddafaf774155a128f692a50abf81d6acb31ea44a7841903ac901d6321b7432286070e688f4d2f4292ebc1e104b33bb6b37a9195408b610639f7dc0b16253670bc", 0xb6, 0x3f}, {&(0x7f0000000740)="c172d785157e0c2e1f60b713655c03d9b21ab9cb3bc7d9af82d5636c9c3f56452ea6bc909e55147f91a6ae1dd0fc9a4018a6e17d6d58132c163c96e83779ead6760a7f9ba82a2d8c5a01494ae45c984b6f7f164a505c725641bd91e47ea87caf4b762f493eaf537354a0719ff3410992e153753563f476664363967ed1f3494c631d09b7a67f7ac5cacba76f3ce4e02fd70866f020dc858c34716f24b6da8867edadbbd4556a46e4a142025cdcaa49f63ec8bb4bc76b", 0xb6, 0x7fffffff}, {&(0x7f0000000f40)="cc3f1a9945cd6c40d8b9ad676d2176ea5c3e37c2d619d82908a7789585b80438e5cb2b288a4a953d0190e43786e87e8e809d7b49ad17f63fddb7458ebb208ba50fcf554055b37d17f04cd525270fe21b238a093ec93fcfdf3bdc7284f1c9f82dffe850ef091f84489c45e859c0bca4942f7d72f426544002d5f4994ce4e6b6d25a8b", 0x82, 0xdda6}, {&(0x7f00000008c0)="38fd38c591563b1b68f68fd33d305ddd82d0db2c643c7943e2f53e37d7421c24d09d0c8115f3d1db23b14b3064918e5ad7049e8db70e6455c8ba9d1f555786e79d5c165d65de80cfb4e69aa5", 0x4c, 0x5}, {&(0x7f0000000940)="44dc7feaf9ab078d94498b80ef53f2f1335f22c9c154ec4c792a566b678eab75a4411cd04afab7e729a4e1625a72838f6b06aed0906664adca5fe28e17bc4969bd2695f241472344d7a9872b5534771d53b16fbfcbdfb75839d83b302b6958d17db8e82dc435af9c8c19ae68f7f2ad325f046cec291f27b484a9233517d8ea40e920542d5ad1e8ca5ff7a1745f74f360e938da0eac7dc347a540e661b558809dc71d4fcc3cfb49edb5ad3c0a485df390cd51004f0a76a4ac042afcd4f6576eb4fa3768dc519a7525ae34f543c33a85aa8e471d08b50abca4c00d3bafb86327e33a28d2836f313830ddd612", 0xeb, 0x6}], 0x800000, &(0x7f0000000ac0)='#\x00') mknod$loop(&(0x7f0000000000)='./file0\x00', 0x401, 0x1) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000bc0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x2c, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x2c}}, 0x0) sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000000f00)={&(0x7f0000000c00)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000c40)=ANY=[@ANYBLOB="463ad5c9", @ANYRES16=r2, @ANYBLOB="00012dbd7000fcdbdf250d0000001c00098008000100001000000800020003000000080001000600000010010180380004001400010002004e23ffffffff0000000000000000200002000a004e230000000300000000000000000000000000000000010000002c000280080003000400000008000300070000000800020007000000080004000300000008000100140000001500010069623a76657468305f746f5f626f6e64000000000d0001007564703a73797a320000000008000300000000002c0004001400010002004e24ac1414aa00000000000000001400020002004e23e00000010000000000000000080003000800000008000300000000002c0004001400010002004e22ac14144400000000000000001400020002004e24ac1414aa00000000000000000d0001007564703a73797a31000000001c00098008000100ffff000008000100070000000800010006000000f00001802c0004001400010002004e20ac14143100000000000000001400020002004e24ac1414aa00000000000000002c000280080001001c00000008000200010000000800040004000000080003000900000008000300030000002c0004001400010002004e23ac1e000100000000000000001400020002004e207f000001000000000000000008000300080000004c0002800800030000000000080001000a000000080002001703000008000400faffffff08000400bd0d00000800020002000000080001000b00000008000300010000000800030003000000110001006574683a6970365f7674693000000000"], 0x24c}, 0x1, 0x0, 0x0, 0x20040005}, 0x20000045) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 20:31:29 executing program 0: mkdir(&(0x7f0000000680)='./file0/file0\x00', 0x30) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/enforce\x00', 0x113200, 0x0) statx(r0, &(0x7f0000000300)='./file0\x00', 0x0, 0x800, &(0x7f0000000400)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000340)='/dev/null\x00', 0x20000, 0x0) sendto$llc(r1, &(0x7f0000000500)="ccf81f153762c33b8a8718910274473f2274d7610b4bebfbc780de379e8dfd0776aa4a9efb7c8ba90e163448f4b6f912eb64d9c91573ca3d765677f073c5c8a66bdb131dcaa94594a9dde619af059f6d6c3196b9ab3e727fa476fd4c731e200adae9a0a565eaa44382184d15c96fc30edcc693267981e30231c2757b9c644043c121f8b13789c0320419811cc4087dd04bb8cc5e24e7818225b0e95d2273d06127acbd039ffd7e11de8f67b13886329b3926baae64a41b91246948092b4d49abeebb96c0415c8eabdd25cff4c783e9331e0086ef869a01e8d912754b816e57d18a2a54e088f51610351cce", 0xeb, 0x44854, &(0x7f0000000600)={0x1a, 0x30a, 0x1, 0x2, 0xcd, 0x1c, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000080)=0x0, &(0x7f0000000180)) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040003,user_id=', @ANYRESDEC=r3, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c00fe4a2b573db5b85b6ea41b0d5e810000000768ea3a56be2fa57bd91ac79535042ada3048497bb73293b6e700a6fa7bce059a8f8c6db22bbcbe5a47d80763d0c0c37831cc12390a2c359aa6c24554a7c883989009c14acc2189f980db4fdcbc5875067a5775b9e3dc542b0bbd53fe521f3f800416daa25477f127a0639da7f8f2279cabe356eb1160a67e0f38f9e50d2cb78cf27b5b73f20453ce4a79cdc0e19c48b2974f2ee69f8e7b644805f6a01e85bfa539da81e06638a4534d51018fac322abc243514369c20d3e7ce9107a15cccf313be26edcf2edf6e26521147bf39b723d800"]) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r4, 0x0, 0x0}, 0x1c) sendto$rose(r4, &(0x7f0000000240)="1a980ce4caf01ff4f0d2d5967cfa559dcca4def1bc27c02acf0317d331122af145a8ce58d47bd4836c6951e670665774602ef0e10c24d9061798645412e827eec495358789e6e054c677dc7115", 0x4d, 0x8040, &(0x7f00000001c0)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}}, 0x1c) 20:31:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000000), &(0x7f0000000880), &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000280), &(0x7f0000000800)=0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r8, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HOP_PENALTY={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) [ 385.881656][T12491] netlink: 'syz-executor.2': attribute type 5 has an invalid length. [ 385.996721][ T33] audit: type=1800 audit(1583267490.059:71): pid=12497 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.2" name="file0" dev="sda1" ino=16641 res=0 [ 386.123213][T12500] netlink: 'syz-executor.2': attribute type 5 has an invalid length. [ 386.257499][T12504] BFS-fs: bfs_fill_super(): No BFS filesystem on loop4 (magic=00000000) [ 386.387021][T12509] nfs4: Unknown parameter '#' 20:31:30 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x3, &(0x7f0000000100)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x2c, 0x25}}, &(0x7f0000000000)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x74) [ 386.425288][T12504] tipc: MTU too low for tipc bearer 20:31:30 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0xffffffffffffffbe, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2400000032001901000000000000000002000000040000000c062e484f91000180a0709164658028aa26f5182c6b25c9edf5faef779d21be2670bf20e0d9794d5d13ffebb3e25280c11f2acd0bc252f961a7c7e9df92e353c6469a0e133d1d8f8a9080547520b904619529547b882948418d1c6332d8ce4151e702e976bf3189030474155a6243b889986c01324fc02fc13c2003169a9837db866f98e911b7f6f2a4b2aa428cbd0c0b52e0e23d3d9db89f30b7754edb81f609a8bab7d9436e82051748c21eb9acdd4dee6cdadb845580d9be"], 0x24}}, 0x0) 20:31:30 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000000), &(0x7f0000000880), &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000280), &(0x7f0000000800)=0x4) 20:31:30 executing program 1: set_mempolicy(0x4003, &(0x7f0000000140)=0x101, 0x2) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000640)="a4cb9df163ffba71140f21f17218fa11feb536d45f6f3a90013d33e2e52869b76856c3aadc95593e3ba302adbfb13e0b0a5138c348e1fc48ef39065774e88890f986c64506cbee5e7463bafe17e792aa092e1eff0f00000000000098dd7dd2b6ee63eebc8f32e3ed24ada587f51ac0d3aab28e7840db757ec729617f613b91cd3908000000dc70dbda126d9df2ee0c8c259ccf62b8c4dfb021ccf01b600d6d4d8e0383469291031fd36860d857f5a561e8afb28c502f1e577371a542c9957deed3292168a1c3b038d618eac076a87e3c3d01431da5bda2942ab52bac569f911d7588ea63564d81f7ca34634481fa41142bd4d229ee3bbc44ed00000000000000000049a635efc404470347142a121637617ce9af6e6fcd86ed34e1a0121407ebc2c4aef397f5754efafd1d0d156b4ba457d41a97db57c944dfa868823d5ad770263d1435d41d9507370a6f902e0cb2bd4730cbdcd277ab73d16d80717da6545630ed3f110ff3814347520a18fb07b182d560ee1a0787412ec3ba094e8d59dfb5e56c9e3763eff7d9d1e0d8133f11c29f49ecdd25ed0188826b595690ddddb742b61bab57ad46b23cc300aa0bee571d4ae2ea5acf68187824be0aa948a6724c48ba5a5e00e373c82dffc8549d82472407ac6cdc844385c9d178ffff4957b8ae2180b9f8a19dc31a81054f672d4d95", 0x1ee, 0xfffffffffffffffe) clone(0x4000000, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000140)="2400000043001f0014f9f407000904000a00071010000100feffffff0800000000000000", 0x24) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x1}, 0xe) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000200)) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000180)=0x10) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x200004) sendfile(r3, r4, 0x0, 0x80001d00c0d0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x60}, &(0x7f0000000100)=0x8) ioctl$TCXONC(r4, 0x540a, 0x3) socket$inet(0x2, 0x80001, 0x84) r5 = syz_open_procfs(0x0, &(0x7f0000000500)='net/softnet_stat\x00') write$UHID_CREATE(r5, &(0x7f0000000440)={0x0, {'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000340)=""/203, 0xcb, 0x99, 0x8, 0x0, 0x7, 0x6}}, 0x11c) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r6, 0x84, 0x10, &(0x7f0000000240)=@sack_info={r2, 0xfffffffb}, &(0x7f0000000280)=0xc) r7 = socket$inet6(0xa, 0x400000000001, 0x5) close(r7) r8 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r8, 0xc040564b, &(0x7f0000000580)={0x15, 0x0, 0x5001, 0xe, 0x3, {0x1, 0x9}, 0x1}) 20:31:30 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x86) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) setsockopt$TIPC_GROUP_LEAVE(r1, 0x10f, 0x88) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:30 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000002e80)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r0) sendmsg$netlink(r3, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)=[{&(0x7f00000001c0)=ANY=[@ANYRES64], 0x1}], 0x1}, 0x0) recvmmsg(r1, &(0x7f00000038c0), 0x3fffffffffffdf5, 0x2, 0x0) 20:31:31 executing program 5: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x80080, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r1, 0x7ff}}, 0x10) write$selinux_validatetrans(r0, &(0x7f0000000100)={'system_u:object_r:shadow_t:s0', 0x20, 'system_u:object_r:ld_so_t:s0', 0x20, 0x9, 0x20, '/usr/sbin/cupsd\x00'}, 0x60) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x88, 0x0, 0x4, 0x70bd2a, 0x25dfdbfe, {}, [@NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0xc55}, @NL80211_ATTR_WIPHY_COVERAGE_CLASS={0x5, 0x59, 0xb0}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x9}, @NL80211_ATTR_WIPHY_TXQ_PARAMS={0x3c, 0x25, 0x0, 0x1, [@NL80211_TXQ_ATTR_CWMIN={0x6, 0x3, 0x8}, @NL80211_TXQ_ATTR_TXOP={0x6, 0x2, 0x5}, @NL80211_TXQ_ATTR_QUEUE={0x5}, @NL80211_TXQ_ATTR_CWMIN={0x6, 0x3, 0x1f}, @NL80211_TXQ_ATTR_QUEUE={0x5, 0x1, 0x5}, @NL80211_TXQ_ATTR_TXOP={0x6, 0x2, 0x2cfa}, @NL80211_TXQ_ATTR_TXOP={0x6, 0x2, 0x1}]}, @NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x1}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_TXQ_QUANTUM={0x8, 0x10c, 0x80}, @NL80211_ATTR_TXQ_MEMORY_LIMIT={0x8}]}, 0x88}, 0x1, 0x0, 0x0, 0x4}, 0x4000080) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000400)={0x0, 0x8001, 0x9}, &(0x7f0000000440)=0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000480)=@assoc_value={r3, 0x1}, &(0x7f00000004c0)=0x8) fstat(r0, &(0x7f0000000500)) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x2c, 0xc, 0x6, 0x903, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x840}, 0x8080) getsockopt$XDP_MMAP_OFFSETS(r0, 0x11b, 0x1, &(0x7f0000000680), &(0x7f0000000700)=0x80) r4 = add_key$keyring(&(0x7f0000000740)='keyring\x00', &(0x7f0000000780)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$clear(0x7, r4) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000007c0)='/dev/sequencer2\x00', 0x10040, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(r5, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x10, 0x1404, 0xd6275ae5edbab1dd, 0x70bd29, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048805) sendmsg$NFT_MSG_GETGEN(r0, &(0x7f00000009c0)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000980)={&(0x7f0000000940)={0x14, 0x10, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x24000080) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/nvram\x00', 0x200002, 0x0) ioctl$VIDIOC_LOG_STATUS(r6, 0x5646, 0x0) clock_gettime(0x0, &(0x7f0000000a40)={0x0, 0x0}) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc044560f, &(0x7f0000000ac0)={0xfc000000, 0x9, 0x4, 0x2000000, 0xffff, {r7, r8/1000+10000}, {0x5, 0xc, 0x3f, 0x7f, 0x6, 0x1e, "3c484dcc"}, 0x0, 0x3, @planes=&(0x7f0000000a80)={0x6, 0x20, @fd, 0x7}, 0x0, 0x0, r0}) setns(r9, 0x28000000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r0, 0xc08c5335, &(0x7f0000000b40)={0x0, 0x4, 0x1, 'queue0\x00', 0x200}) r10 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000c00)='/dev/vsock\x00', 0x14000, 0x0) ioctl$VHOST_SET_LOG_BASE(r10, 0x4008af04, &(0x7f0000000c80)=&(0x7f0000000c40)) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000cc0)='/dev/ttyprintk\x00', 0x2400, 0x0) r11 = syz_open_dev$audion(&(0x7f0000000d00)='/dev/audio#\x00', 0x0, 0x100) write$P9_RREADDIR(r11, &(0x7f0000000d40)={0xa6, 0x29, 0x8, {0x2, [{{0x40, 0x4, 0x5}, 0x81, 0x9, 0x7, './file0'}, {{0x80, 0x3}, 0x6, 0x3f, 0x7, './file0'}, {{0x0, 0x4, 0x5}, 0x10000, 0x1, 0x7, './file0'}, {{0x20, 0x2}, 0x7fffffff, 0x2, 0x7, './file0'}, {{0x10, 0x2, 0x1}, 0x5, 0x6, 0x7, './file0'}]}}, 0xa6) io_uring_setup(0x563, &(0x7f0000000e00)={0x0, 0x0, 0xc, 0x3, 0x6e}) r12 = openat$zero(0xffffffffffffff9c, &(0x7f0000000e80)='/dev/zero\x00', 0x2000, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000ec0)={0x0, 0x400, 0x20}, &(0x7f0000000f00)=0xc) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r12, 0x84, 0x13, &(0x7f0000000f40)={r13, 0xb48}, &(0x7f0000000f80)=0x8) 20:31:31 executing program 2: syz_open_procfs(0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r1, &(0x7f0000001a40)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x1) pipe(0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/mcfilter\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x2f) 20:31:31 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) getpeername$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x1c) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) getresuid(&(0x7f0000000000), &(0x7f0000000880), &(0x7f00000008c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) [ 387.580669][T12552] __nla_validate_parse: 5 callbacks suppressed [ 387.580700][T12552] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 20:31:31 executing program 0: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 20:31:31 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_GATEWAYS(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) 20:31:32 executing program 0: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4003}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r1, 0x0, 0x0}, 0x20) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r2, 0x0, 0x0}, 0x20) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r3, 0x0, 0x0}, 0x20) ioctl$VIDIOC_QBUF(r1, 0xc044560f, &(0x7f0000000180)={0x5, 0xb, 0x4, 0xe000, 0x9, {}, {0x3, 0x0, 0x0, 0xff, 0x2, 0x62, "cdb6e189"}, 0x0, 0x4, @fd=r2, 0x15, 0x0, r3}) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000000)=@sack_info={0x0, 0xc720, 0x3}, &(0x7f0000000080)=0xc) setresuid(0x0, 0x0, 0xee00) lchown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 388.158223][T12566] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 20:31:32 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x4340100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x7, 0x4, 0x8, 0x1, 0x0, 0x1, 0x0, [0x5]}, 0x3c) pipe(&(0x7f0000000340)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 20:31:32 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x80000101005, 0x0) r1 = dup2(r0, r0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000000)=""/246) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000300)) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000ac0)=0x41064) pwritev(r0, &(0x7f00000001c0)=[{&(0x7f0000000340)="0021c3f0d20800000000000600"/22, 0x16}], 0x1, 0x0) [ 388.392876][T12570] IPVS: ftp: loaded support on port[0] = 21 20:31:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) delete_module(&(0x7f0000000640)='batadv\x00', 0x0) r3 = socket(0x2b, 0x80000, 0x20) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = accept4(r0, &(0x7f0000000380)=@pppoe={0x18, 0x0, {0x0, @multicast}}, &(0x7f0000000400)=0x80, 0x1800) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r6, 0x0, 0x0}, 0x20) sendmsg$nl_route(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000680)=ANY=[@ANYBLOB="4800000010000000008000"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c0001007665746800000000180002000000010000000000", @ANYBLOB="c118ff229d1c622ed30c3f7f565ab19e0bb361302c1d222d45983032e0ca74dd107d12247a870380f50b84ffdf8b0b666274d61b283c12be8fde6feba7f50c7e0581ab9c5ffda1bb3eb9143889404e580c7cbb955fb4204109a7e5df45f128ebd3fd7581837dfd44c2cc67acb104610b2943fa85cff409e25f19d6f61933dc2dbe58870a19d98d5d7f20158b8feeab9b56b1ee81e73720aabd5915ab37e42a", @ANYBLOB="0000000000000000db881e3fb4599c9b7cbbeeeacbe34a"], 0x5}, 0x1, 0x0, 0x0, 0x804}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x6c, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r4, @ANYBLOB="0120010017ceb999eb001c00ef0000004cb4df1b7c"], 0x28}}, 0x0) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r7, 0x0, 0x0}, 0x20) r8 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0)='batadv\x00') r9 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x208101, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r5, &(0x7f0000000600)={&(0x7f0000000500), 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x10, 0x3f2, 0x100, 0x70bd28, 0x25dfdbfc, "", ["", "", "", "", "", ""]}, 0x10}}, 0x4055) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r9, 0x0, 0x0}, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000440)) r10 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x7e3841, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001140)={r10, 0x0, 0x0}, 0x20) ioctl$sock_inet6_udp_SIOCINQ(r10, 0x541b, &(0x7f00000004c0)) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="110700000000f0ffffff0800000004000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0) [ 388.672572][T12578] ===================================================== [ 388.679576][T12578] BUG: KMSAN: uninit-value in slhc_compress+0x5b9/0x2e60 [ 388.686603][T12578] CPU: 1 PID: 12578 Comm: syz-executor.2 Not tainted 5.6.0-rc2-syzkaller #0 [ 388.695261][T12578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 388.705308][T12578] Call Trace: [ 388.708600][T12578] dump_stack+0x1c9/0x220 [ 388.712938][T12578] kmsan_report+0xf7/0x1e0 [ 388.717349][T12578] __msan_warning+0x58/0xa0 [ 388.721853][T12578] slhc_compress+0x5b9/0x2e60 [ 388.726520][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 388.732333][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 388.738223][T12578] ? __alloc_skb+0x762/0xac0 [ 388.742814][T12578] ? kmsan_get_metadata+0x11d/0x180 [ 388.748004][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 388.753802][T12578] __ppp_xmit_process+0x1902/0x2970 [ 388.759022][T12578] ppp_xmit_process+0x147/0x2f0 [ 388.763872][T12578] ppp_write+0x6bb/0x790 [ 388.768118][T12578] ? ppp_read+0xbf0/0xbf0 [ 388.772438][T12578] do_iter_write+0x812/0xdc0 [ 388.777022][T12578] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 388.783186][T12578] compat_writev+0x2df/0x5a0 [ 388.787785][T12578] ? kmsan_get_metadata+0x11d/0x180 [ 388.792975][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 388.798773][T12578] __ia32_compat_sys_pwritev+0x349/0x3f0 [ 388.804522][T12578] ? __x32_compat_sys_pwritev64+0x3b0/0x3b0 [ 388.810409][T12578] do_fast_syscall_32+0x3c7/0x6e0 [ 388.815438][T12578] entry_SYSENTER_compat+0x68/0x77 [ 388.820541][T12578] RIP: 0023:0xf7f0dd99 [ 388.824613][T12578] Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 388.844213][T12578] RSP: 002b:00000000f5d080cc EFLAGS: 00000296 ORIG_RAX: 000000000000014e [ 388.852620][T12578] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 [ 388.860582][T12578] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 388.868547][T12578] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 388.876511][T12578] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 388.884474][T12578] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 388.892446][T12578] [ 388.894760][T12578] Uninit was created at: [ 388.898994][T12578] kmsan_internal_poison_shadow+0x66/0xd0 [ 388.904701][T12578] kmsan_slab_alloc+0x8a/0xe0 [ 388.909364][T12578] __kmalloc_node_track_caller+0xb40/0x1200 [ 388.915247][T12578] __alloc_skb+0x2fd/0xac0 [ 388.919652][T12578] ppp_write+0x115/0x790 [ 388.923877][T12578] do_iter_write+0x812/0xdc0 [ 388.928455][T12578] compat_writev+0x2df/0x5a0 [ 388.933033][T12578] __ia32_compat_sys_pwritev+0x349/0x3f0 [ 388.938649][T12578] do_fast_syscall_32+0x3c7/0x6e0 [ 388.943660][T12578] entry_SYSENTER_compat+0x68/0x77 [ 388.948760][T12578] ===================================================== [ 388.955674][T12578] Disabling lock debugging due to kernel taint [ 388.961809][T12578] Kernel panic - not syncing: panic_on_warn set ... [ 388.968384][T12578] CPU: 1 PID: 12578 Comm: syz-executor.2 Tainted: G B 5.6.0-rc2-syzkaller #0 [ 388.978423][T12578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 388.988463][T12578] Call Trace: [ 388.991751][T12578] dump_stack+0x1c9/0x220 [ 388.996083][T12578] panic+0x3d5/0xc3e [ 388.999997][T12578] kmsan_report+0x1df/0x1e0 [ 389.004495][T12578] __msan_warning+0x58/0xa0 [ 389.009033][T12578] slhc_compress+0x5b9/0x2e60 [ 389.013701][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 389.019505][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 389.025304][T12578] ? __alloc_skb+0x762/0xac0 [ 389.029890][T12578] ? kmsan_get_metadata+0x11d/0x180 [ 389.035196][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 389.040998][T12578] __ppp_xmit_process+0x1902/0x2970 [ 389.046226][T12578] ppp_xmit_process+0x147/0x2f0 [ 389.051078][T12578] ppp_write+0x6bb/0x790 [ 389.055329][T12578] ? ppp_read+0xbf0/0xbf0 [ 389.059653][T12578] do_iter_write+0x812/0xdc0 [ 389.064246][T12578] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 389.070415][T12578] compat_writev+0x2df/0x5a0 [ 389.075018][T12578] ? kmsan_get_metadata+0x11d/0x180 [ 389.080221][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 389.086022][T12578] __ia32_compat_sys_pwritev+0x349/0x3f0 [ 389.091672][T12578] ? __x32_compat_sys_pwritev64+0x3b0/0x3b0 [ 389.097558][T12578] do_fast_syscall_32+0x3c7/0x6e0 [ 389.102597][T12578] entry_SYSENTER_compat+0x68/0x77 [ 389.107709][T12578] RIP: 0023:0xf7f0dd99 [ 389.111779][T12578] Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 389.131377][T12578] RSP: 002b:00000000f5d080cc EFLAGS: 00000296 ORIG_RAX: 000000000000014e [ 389.139778][T12578] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 [ 389.147737][T12578] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 389.155697][T12578] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 389.163656][T12578] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 389.171620][T12578] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 389.180258][T12578] ------------[ cut here ]------------ [ 389.185691][T12578] kernel BUG at mm/kmsan/kmsan.h:87! [ 389.190995][T12578] invalid opcode: 0000 [#1] SMP [ 389.195824][T12578] CPU: 1 PID: 12578 Comm: syz-executor.2 Tainted: G B 5.6.0-rc2-syzkaller #0 [ 389.205863][T12578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 389.216046][T12578] RIP: 0010:kmsan_internal_check_memory+0x3c0/0x3d0 [ 389.222612][T12578] Code: 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 48 c7 c7 06 4c a8 b5 31 c0 e8 e1 70 48 ff 0f 0b 0f 0b 0f 0b 0f 0b e8 02 8f 48 ff 0f 0b <0f> 0b 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 83 ff [ 389.242201][T12578] RSP: 0018:ffffbbdf8a4ff3a8 EFLAGS: 00010046 [ 389.248241][T12578] RAX: 0000000000000002 RBX: 00000000078f00a2 RCX: 00000000078f00a2 [ 389.256198][T12578] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffbbdf8a4ff484 [ 389.264154][T12578] RBP: ffffbbdf8a4ff450 R08: 0000000000000000 R09: ffffa1776fd28ed0 [ 389.272103][T12578] R10: 0000000000000000 R11: ffffffffac816f70 R12: 0000000000000000 [ 389.280051][T12578] R13: 0000000000000001 R14: 0000000000000002 R15: 0000000000000001 [ 389.288007][T12578] FS: 0000000000000000(0000) GS:ffffa1776fd00000(0063) knlGS:00000000f5d08b40 [ 389.296915][T12578] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 389.303513][T12578] CR2: 0000000030f22000 CR3: 000000001e181000 CR4: 00000000001406e0 [ 389.311464][T12578] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 389.319416][T12578] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 389.327364][T12578] Call Trace: [ 389.330658][T12578] kmsan_check_memory+0xd/0x10 [ 389.335404][T12578] iowrite8+0x99/0x2e0 [ 389.339470][T12578] pvpanic_panic_notify+0x99/0xc0 [ 389.344477][T12578] ? pvpanic_mmio_remove+0x60/0x60 [ 389.349579][T12578] atomic_notifier_call_chain+0x12a/0x240 [ 389.355283][T12578] panic+0x468/0xc3e [ 389.359176][T12578] kmsan_report+0x1df/0x1e0 [ 389.363665][T12578] __msan_warning+0x58/0xa0 [ 389.368150][T12578] slhc_compress+0x5b9/0x2e60 [ 389.372809][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 389.378606][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 389.384394][T12578] ? __alloc_skb+0x762/0xac0 [ 389.388969][T12578] ? kmsan_get_metadata+0x11d/0x180 [ 389.394150][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 389.400007][T12578] __ppp_xmit_process+0x1902/0x2970 [ 389.405215][T12578] ppp_xmit_process+0x147/0x2f0 [ 389.410051][T12578] ppp_write+0x6bb/0x790 [ 389.414278][T12578] ? ppp_read+0xbf0/0xbf0 [ 389.418588][T12578] do_iter_write+0x812/0xdc0 [ 389.423163][T12578] ? __msan_metadata_ptr_for_store_8+0x13/0x20 [ 389.429319][T12578] compat_writev+0x2df/0x5a0 [ 389.433908][T12578] ? kmsan_get_metadata+0x11d/0x180 [ 389.439089][T12578] ? kmsan_get_shadow_origin_ptr+0x81/0xb0 [ 389.444873][T12578] __ia32_compat_sys_pwritev+0x349/0x3f0 [ 389.450552][T12578] ? __x32_compat_sys_pwritev64+0x3b0/0x3b0 [ 389.456435][T12578] do_fast_syscall_32+0x3c7/0x6e0 [ 389.461456][T12578] entry_SYSENTER_compat+0x68/0x77 [ 389.466544][T12578] RIP: 0023:0xf7f0dd99 [ 389.470594][T12578] Code: 90 e8 0b 00 00 00 f3 90 0f ae e8 eb f9 8d 74 26 00 89 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 389.490187][T12578] RSP: 002b:00000000f5d080cc EFLAGS: 00000296 ORIG_RAX: 000000000000014e [ 389.498579][T12578] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 [ 389.506567][T12578] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 389.514516][T12578] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 389.522470][T12578] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 389.530417][T12578] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 389.538382][T12578] Modules linked in: [ 389.542261][T12578] ---[ end trace c0ca9e1b1c7ab204 ]--- [ 389.547702][T12578] RIP: 0010:kmsan_internal_check_memory+0x3c0/0x3d0 [ 389.554264][T12578] Code: 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 48 c7 c7 06 4c a8 b5 31 c0 e8 e1 70 48 ff 0f 0b 0f 0b 0f 0b 0f 0b e8 02 8f 48 ff 0f 0b <0f> 0b 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 83 ff [ 389.573847][T12578] RSP: 0018:ffffbbdf8a4ff3a8 EFLAGS: 00010046 [ 389.579889][T12578] RAX: 0000000000000002 RBX: 00000000078f00a2 RCX: 00000000078f00a2 [ 389.587875][T12578] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffbbdf8a4ff484 [ 389.595825][T12578] RBP: ffffbbdf8a4ff450 R08: 0000000000000000 R09: ffffa1776fd28ed0 [ 389.603773][T12578] R10: 0000000000000000 R11: ffffffffac816f70 R12: 0000000000000000 [ 389.611720][T12578] R13: 0000000000000001 R14: 0000000000000002 R15: 0000000000000001 [ 389.619679][T12578] FS: 0000000000000000(0000) GS:ffffa1776fd00000(0063) knlGS:00000000f5d08b40 [ 389.628624][T12578] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 389.635189][T12578] CR2: 0000000030f22000 CR3: 000000001e181000 CR4: 00000000001406e0 [ 389.643191][T12578] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 389.651210][T12578] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 389.659194][T12578] Kernel panic - not syncing: Fatal exception in interrupt [ 389.667105][T12578] Kernel Offset: 0x26600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 389.678719][T12578] Rebooting in 86400 seconds..